Medium

Analysis Summary

CVE-2024-31904 CVSS:6.5

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of service due to an uncaught exception.

CVE-2024-31895 CVSS:4.3

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token.

CVE-2024-31894 CVSS:4.3

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token.

CVE-2024-31893 CVSS:4.3

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token.

Impact

• Denial of Service
• Information Disclosure

Indicators of Compromise

CVE

• CVE-2024-31904
• CVE-2024-31895
• CVE-2024-31894
• CVE-2024-31893

Affected Vendors

Remediation

Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.

CVE-2024-31904

CVE-2024-31895

CVE-2024-31894

CVE-2024-31893