EUVD-2024-54763
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.
Analysis
IBM OpenPages with Watson 8.3 and 9.0
could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.
Technical Context
This vulnerability is classified as Use of a Broken or Risky Cryptographic Algorithm (CWE-327).
Affected Products
Affected products: Ibm Openpages With Watson
Remediation
A vendor patch is available. Apply it as soon as possible and verify the fix.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today