CVE-2024-45653 MEDIUM

CVE-2024-45653: IBM Sterling Connect:Direct Web Services information disclosure

Vendor Ibm
Product Sterling Connect:Direct Web Services
Weakness CWE-201
Published January 19, 2025
Last update January 21, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system.

Key dates

02Disclosure timeline

January 19, 2025 CVE published
January 21, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVE-2024-4536 Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability CVE-2025-62947 WordPress Publitio plugin <= 2.2.5 - Sensitive Data Exposure vulnerability CVE-2025-24639 WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerability CVE-2026-28481 OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching