Vulnerability · Published Feb 20, 2025 · Assigned by ibm

CVE-2024-49344IBM OpenPages session fixation

Medium 4.3

In plain English

A medium-severity session fixation in OpenPages with Watson from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages with Watson Assistant chat feature enabled the application establishes a session when a user logs in and uses chat, but the chat session is still left active after logout.

Affected products (as reported)

Vendor	Product	Versions
IBM	OpenPages with Watson	8.39.0

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://www.ibm.com/support/pages/node/7183541 vendor-advisory, patch