IBM Engineering Insights 7.0.2/7.0.3 Engineering Lifecycle Optimization reverse tabnabbing

Summaryinfo

A vulnerability identified as problematic has been detected in IBM Engineering Insights 7.0.2/7.0.3. Affected is an unknown function of the component Engineering Lifecycle Optimization. The manipulation leads to reverse tabnabbing. This vulnerability is uniquely identified as CVE-2024-39727. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM Engineering Insights 7.0.2/7.0.3. It has been rated as problematic. This issue affects some unknown functionality of the component Engineering Lifecycle Optimization. The manipulation with an unknown input leads to a reverse tabnabbing vulnerability. Using CWE to declare the problem leads to CWE-1022. The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property. Impacted is confidentiality, and integrity. The summary by CVE is:

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.

The advisory is shared at ibm.com. The identification of this vulnerability is CVE-2024-39727 since 06/28/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/11/2025).

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• IBM

Name

• Engineering Insights

Version

• 7.0.2
• 7.0.3

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion