{"id":"CVE-2024-35160","state":"PUBLISHED","title":"IBM Watson Query on Cloud Pak for Data and IBM Db2 Big SQL on Cloud Pak for Data information disclosure","description":"IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration.","publishedAt":"2024-11-23T13:48:16.110Z","updatedAt":"2024-11-24T12:30:18.144Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Watson Query for Cloud Pak for Data","IBM Db2 Big SQL on Cloud Pak for Data"],"affected":[{"vendor":"IBM","product":"Watson Query for Cloud Pak for Data","defaultStatus":"unaffected","versions":[{"version":"1.8, 2.0, 2.1, 2.2","status":"affected"}],"cpes":["cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:1.8:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:2.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:2.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.6:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Db2 Big SQL on Cloud Pak for Data","defaultStatus":"unaffected","versions":[{"version":"7.3, 7.4, 7.5, 7.6","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/7168703","https://www.ibm.com/support/pages/node/7176947"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/35xxx/CVE-2024-35160.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-35160","state":"PUBLISHED","datePublished":"2024-11-23T13:48:16.110Z","dateUpdated":"2024-11-24T12:30:18.144Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2024-05-09T16:27:47.448Z"},"containers":{"cna":{"title":"IBM Watson Query on Cloud Pak for Data and IBM Db2 Big SQL on Cloud Pak for Data information disclosure","descriptions":[{"lang":"en","value":"IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration."}],"affected":[{"vendor":"IBM","product":"Watson Query for Cloud Pak for Data","defaultStatus":"unaffected","versions":[{"version":"1.8, 2.0, 2.1, 2.2","status":"affected"}],"cpes":["cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:1.8:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:2.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watson_query_with_cloud_pak_for_data_as_a_service:2.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:big_sql:7.6:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Db2 Big SQL on Cloud Pak for Data","defaultStatus":"unaffected","versions":[{"version":"7.3, 7.4, 7.5, 7.6","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7168703","tags":["vendor-advisory"]},{"url":"https://www.ibm.com/support/pages/node/7176947","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613 Insufficient Session Expiration","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2024-11-23T13:48:16.110Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-24T12:30:09.564089Z","id":"CVE-2024-35160","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-24T12:30:18.144Z"}}]}}}