Medium severity · published Aug 22, 2024
CVE-2024-39746
IBM Sterling Connect:Direct Web Services information disclosure
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Sterling Connect:Direct Web Services · IBM
6.0; 6.1; 6.2; 6.3 · source: vendor
SC
Sterling Connect Direct Web Services · Ibm
6.0; 6.1.0; 6.2.0; 6.3.0 · source: NVD
Affected product
SC
Sterling Connect:Direct Web Services
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39746
Vendor Advisory
https://www.ibm.com/support/pages/node/7166018
More from Sterling Connect:Direct Web Services
8.4
CVE-2026-105453
IBM Sterling Connect:Direct for Unix Improper Privilege Management
7.8
CVE-2026-93888
IBM Sterling Connect:Direct for Unix Buffer Overflow
7.8
CVE-2020-4587
IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking
7.5
CVE-2024-39745
IBM Sterling Connect:Direct Web Services information disclosure
7.5
CVE-2021-38891
IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information