CVE-2024-49780CWE-22

IBM OpenPages path traversal

Medium · published February 20, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00568 · 46.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-02-20T03:49Z
EPSS history
Timeline
  • 20 FEB 03:49Z
    IBM OpenPages path traversal
    cvelistv5