by Kastro
Paper/Archive/CVE-2024-43177

CVE-2024-43177

IBM Concert — IBM Concert improper certificate validation

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 25.1.251 × 205.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.

Affected

ProductAffectedFixed inSource
Concert1.0.0, 1.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisoryibm.com/support/pages/node/7173596