CVE-2024-22334

low-risk
Published 2024-04-12

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. When deleting a custom security type, associated permissions of objects using that type may not be fully revoked. This could lead to incorrect reporting of permission configuration and unexpected privileges being retained. IBM X-Force ID: 279974.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.4/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Devops Deploy

Affected Vendors

Ibm

References (4)

VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/279974
Vendor Advisory https://www.ibm.com/support/pages/node/7148112
VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/279974
Vendor Advisory https://www.ibm.com/support/pages/node/7148112
21
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 7/34 · Low