{"id":904,"date":"2025-04-23T05:57:52","date_gmt":"2025-04-23T05:57:52","guid":{"rendered":"http:\/\/localhost\/?p=904"},"modified":"2025-04-23T05:57:52","modified_gmt":"2025-04-23T05:57:52","slug":"security-bulletin-multiple-vulnerabilities-in-ibm-tivoli-monitoring-affect-ibm-cloud-pak-system","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=904","title":{"rendered":"Security Bulletin: Multiple vulnerabilities in IBM Tivoli Monitoring affect IBM Cloud Pak System"},"content":{"rendered":"
\n

Vulnerability Details<\/h2>\n
\n

Basic Information<\/h3>\n\n\n\n\n\n\n
Title<\/th>\nSecurity Bulletin: Multiple vulnerabilities in IBM Tivoli Monitoring affect IBM Cloud Pak System<\/td>\n<\/tr>\n
Type<\/th>\nibm<\/td>\n<\/tr>\n
Published<\/th>\n2025-04-22T15:21:55<\/td>\n<\/tr>\n
Last Seen<\/th>\n2025-04-22T18:56:24<\/td>\n<\/tr>\n
CVSS Score<\/th>\n8.8 (HIGH)<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVSS v3 Details<\/h3>\n\n\n\n\n\n\n\n\n\n
Attack Vector<\/th>\nNETWORK<\/td>\n<\/tr>\n
Attack Complexity<\/th>\nLOW<\/td>\n<\/tr>\n
Privileges Required<\/th>\nLOW<\/td>\n<\/tr>\n
User Interaction<\/th>\nNONE<\/td>\n<\/tr>\n
Scope<\/th>\nUNCHANGED<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\nHIGH<\/td>\n<\/tr>\n
Integrity Impact<\/th>\nHIGH<\/td>\n<\/tr>\n
Availability Impact<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVE Information<\/h3>\n\n\n\n\n
CVE IDs<\/th>\nCVE-2024-35154, CVE-2024-37532<\/td>\n<\/tr>\n
CWE<\/th>\n<\/td>\n<\/tr>\n
Bulletin Family<\/th>\nsoftware<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

Description<\/h3>\n
\n ## Summary<\/p>\n

Multiple vulnerabilities in IBM Tivoli Monitoring affect IBM Cloud Pak System.<\/p>\n

## Vulnerability Details<\/p>\n

**CVEID:**CVE-2024-35154
\n**DESCRIPTION:** IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.
\n**CWE:**CWE-250: Execution with Unnecessary Privileges
\n**CVSS Source:** IBM X-Force
\n**CVSS Base score:** 7.2
\n**CVSS Vector:**(CVSS:3.0\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H) <\/p>\n

**CVEID:**CVE-2024-37532
\n**DESCRIPTION:** IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
\n**CWE:**CWE-347: Improper Verification of Cryptographic Signature
\n**CVSS Source:** IBM X-Force
\n**CVSS Base score:** 8.8
\n**CVSS Vector:**(CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H)<\/p>\n

## Affected Products and Versions<\/p>\n

Affected Product(s)| Version(s) (Intel)
\n—|—
\nIBM Cloud Pak System| 2.3.3.0
\nIBM Cloud Pak System| 2.3.3.3 2.3.3.3 IFix01
\nIBM Cloud Pak System| 2.3.3.4
\nIBM Cloud Pak System Software Suite| 2.3.3.5
\nIBM Cloud Pak System| 2.3.3.6 2.3.3.6 IFix01 2.3.3.6 IFix02
\nIBM Cloud Pak System| 2.3.4.0
\nIBM Cloud Pak System| 2.3.4.1
\nAffected Product(s)| Version(s) (Power)
\nIBM Cloud Pak System| 2.3.3.7 2.3.3.7 Ifix1
\nIBM Cloud Pak System| 2.3.5.0 <\/p>\n

## Remediation\/Fixes<\/p>\n

Cloud Pak System release v2.3.4.1 iFix1 with IBM Tivoli Monitoring 6.3.0 Fix Pack 7 Service Pack 18.<\/p>\n

IBM strongly recommends addressing the vulnerability now by applying the fix reported below.<\/p>\n

For system W4600\/MT 9568-CVM, Intel platform, <\/p>\n

upgrade IBM Cloud Pak System v2.3.4.1 iFix 1 available at IBM Fix Central<\/p>\n

information on upgrading at https:\/\/www.ibm.com\/support\/pages\/node\/7178546<\/p>\n

For Power, contact IBM Support.<\/p>\n

For unsupported versions the recommendation is to upgrade to supported version of the product.<\/p>\n

## Workarounds and Mitigations<\/p>\n

None<\/p>\n

##\n <\/p><\/div>\n<\/p><\/div>\n

\n

Impact Assessment<\/h3>\n\n\n\n
Base Score<\/th>\n8.8<\/td>\n<\/tr>\n
Severity<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

View full CVE details<\/a><\/p>\n<\/p><\/div>\n<\/div>\n