Vulnerability · Published Feb 20, 2025 · Assigned by ibm

CVE-2024-49780IBM OpenPages path traversal

Medium 5.3

In plain English

A medium-severity path traversal in OpenPages with Watson from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.

Affected products (as reported)

Vendor	Product	Versions
IBM	OpenPages with Watson	8.39.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://www.ibm.com/support/pages/node/7183541 vendor-advisory, patch