CVE-2024-54181

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7179994	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ibm:websphere_automation:1.7.5:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

History

28 Mar 2025, 16:32

Type	Values Removed	Values Added
CPE		cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:a:ibm:websphere_automation:1.7.5:::::::*
References	~~() https://www.ibm.com/support/pages/node/7179994 -~~	() https://www.ibm.com/support/pages/node/7179994 - Vendor Advisory
Summary		(es) IBM WebSphere Automation 1.7.5 podría permitir que un usuario remoto con privilegios, que tenga acceso autorizado a la interfaz de usuario de Swagger, ejecute código arbitrario. Mediante una entrada especialmente manipulada, el usuario podría aprovechar esta vulnerabilidad para ejecutar código arbitrario en el sistema.
First Time		Ibm websphere Automation Linux linux Kernel Ibm Linux

30 Dec 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-30 14:15

Updated : 2025-03-28 16:32

NVD link : CVE-2024-54181

Mitre link : CVE-2024-54181

CVE.ORG link : CVE-2024-54181

JSON object : View

Products Affected

ibm

websphere_automation

linux

linux_kernel

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2024-54181", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-12-30T14:15:05.867", "references": [{"url": "https://www.ibm.com/support/pages/node/7179994", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system."}, {"lang": "es", "value": "IBM WebSphere Automation 1.7.5 podr\u00eda permitir que un usuario remoto con privilegios, que tenga acceso autorizado a la interfaz de usuario de Swagger, ejecute c\u00f3digo arbitrario. Mediante una entrada especialmente manipulada, el usuario podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el sistema."}], "lastModified": "2025-03-28T16:32:40.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_automation:1.7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "698AA3DD-7377-4B1F-B5C2-93D1A6328A2E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}

7.2 /10