Security Bulletin: Multiple vulnerabilities in IBM Tivoli Monitoring affect IBM Cloud Pak System

Multiple vulnerabilities in IBM Tivoli Monitoring affect IBM Cloud Pak System.

## Vulnerability Details

**CVEID:**CVE-2024-35154
**DESCRIPTION:** IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.
**CWE:**CWE-250: Execution with Unnecessary Privileges
**CVSS Source:** IBM X-Force
**CVSS Base score:** 7.2
**CVSS Vector:**(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

**CVEID:**CVE-2024-37532
**DESCRIPTION:** IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
**CWE:**CWE-347: Improper Verification of Cryptographic Signature
**CVSS Source:** IBM X-Force
**CVSS Base score:** 8.8
**CVSS Vector:**(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

## Affected Products and Versions

Affected Product(s)| Version(s) (Intel)
—|—
IBM Cloud Pak System| 2.3.3.0
IBM Cloud Pak System| 2.3.3.3 2.3.3.3 IFix01
IBM Cloud Pak System| 2.3.3.4
IBM Cloud Pak System Software Suite| 2.3.3.5
IBM Cloud Pak System| 2.3.3.6 2.3.3.6 IFix01 2.3.3.6 IFix02
IBM Cloud Pak System| 2.3.4.0
IBM Cloud Pak System| 2.3.4.1
Affected Product(s)| Version(s) (Power)
IBM Cloud Pak System| 2.3.3.7 2.3.3.7 Ifix1
IBM Cloud Pak System| 2.3.5.0

## Remediation/Fixes

Cloud Pak System release v2.3.4.1 iFix1 with IBM Tivoli Monitoring 6.3.0 Fix Pack 7 Service Pack 18.

IBM strongly recommends addressing the vulnerability now by applying the fix reported below.

For system W4600/MT 9568-CVM, Intel platform,

upgrade IBM Cloud Pak System v2.3.4.1 iFix 1 available at IBM Fix Central

information on upgrading at https://www.ibm.com/support/pages/node/7178546

For Power, contact IBM Support.

For unsupported versions the recommendation is to upgrade to supported version of the product.

## Workarounds and Mitigations

None

##