IBM Log Analysis CVE-2024-40683 TOCTOU Authentication Bypass Vulnerability

Vulnerability Overview IBM Operations Analytics - Log Analysis contains a Time-of-Check to Time-of-Use (TOCTOU) weakness that allows active sessions to persist after a password change. This vulnerability is assigned the CVE identifier CVE-2024-40683 and has a CVSS base score of 6.3. Impact Scope Affected Product: IBM Operations Analytics - Log Analysis Affected Versions: - 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3 - 1.3.6.0, 1.3.6.1 - 1.3.7.0, 1.3.7.1, 1.3.7.2 - 1.3.8.0, 1.3.8.1, 1.3.8.2 - 1.3.8.3, 1.3.8.4 Remediation IBM strongly recommends resolving this vulnerability immediately by applying version 1.3.8.5 (1.3.8-TIV-IOALA-FPS-sign). Refer to the README for upgrade instructions. For versions earlier than Log Analysis 1.3.8.4, an upgrade to Log Analysis 1.3.8.4 is recommended. Additional Information CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Workspace Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey the severity of a vulnerability and to assist in determining the urgency and priority of the response. IBM provides CVSS scores "as is" and makes no express or implied warranties for any particular purpose. It is the customer's responsibility to evaluate the impact of the vulnerability on their environment. IBM periodically updates product component records and may identify packages that were previously undiscovered. IBM does not guarantee that the referenced products have been used since that date, nor does IBM guarantee that it was aware of the vulnerability at the time the vulnerability date occurred. The listed affected products and versions are intended to reflect only those products and versions that are supported and not expired by IBM. Therefore, the omission of unsupported or extended support products and versions does not constitute an IBM determination that they are unaffected by the vulnerability. Citing one or more unsupported versions does not obligate IBM to remediate any unsupported or extended support product or version.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Log Analysis CVE-2024-40683 TOCTOU Authentication Bypass Vulnerability