IBM Sterling B2B Integrator up to 6.1.2.5/6.2.0.3 Filename information exposure

Summaryinfo

A vulnerability identified as problematic has been detected in IBM Sterling B2B Integrator up to 6.1.2.5/6.2.0.3. This vulnerability affects unknown code of the component Filename Handler. The manipulation leads to information exposure. This vulnerability is referenced as CVE-2024-45089. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in IBM Sterling B2B Integrator up to 6.1.2.5/6.2.0.3. This issue affects some unknown functionality of the component Filename Handler. The manipulation with an unknown input leads to a information exposure vulnerability. Using CWE to declare the problem leads to CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. Impacted is confidentiality. The summary by CVE is:

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensitive filename information due to an observable discrepancy.

It is possible to read the advisory at ibm.com. The identification of this vulnerability is CVE-2024-45089 since 08/21/2024. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• IBM

Name

• Sterling B2B Integrator

Version

• 6.1.2.0
• 6.1.2.1
• 6.1.2.2
• 6.1.2.3
• 6.1.2.4
• 6.1.2.5
• 6.2.0.0
• 6.2.0.1
• 6.2.0.2
• 6.2.0.3

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion