{"id":"CVE-2024-35154","state":"PUBLISHED","title":"IBM WebSphere Application Server code execution","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.","publishedAt":"2024-07-09T21:57:32.820Z","updatedAt":"2024-08-02T03:07:46.791Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM WebSphere Application Server"],"affected":[{"vendor":"IBM","product":"WebSphere Application Server","defaultStatus":"unaffected","versions":[{"version":"8.5, 9.0","status":"affected"}],"cpes":["cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7159825","https://exchange.xforce.ibmcloud.com/vulnerabilities/292641"],"weaknesses":["CWE-250"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/35xxx/CVE-2024-35154.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-35154","state":"PUBLISHED","datePublished":"2024-07-09T21:57:32.820Z","dateUpdated":"2024-08-02T03:07:46.791Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2024-05-09T16:27:47.446Z"},"containers":{"cna":{"title":"IBM WebSphere Application Server code execution","descriptions":[{"lang":"en","value":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641."}],"affected":[{"vendor":"IBM","product":"WebSphere Application Server","defaultStatus":"unaffected","versions":[{"version":"8.5, 9.0","status":"affected"}],"cpes":["cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7159825","tags":["vendor-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/292641","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-250","description":"CWE-250 Execution with Unnecessary Privileges","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2024-07-09T21:57:32.820Z"},"credits":[{"lang":"en","type":"finder","value":"Kin Hung Cheng"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-10T13:14:17.639454Z","id":"CVE-2024-35154","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-10T13:14:29.553Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/7159825","tags":["vendor-advisory","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/292641","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:07:46.791Z"}}]}}}