CVE-2024-22317

The vulnerability mechanism (CWE-307) consists of a lack of proper limitation on excessive login attempts. An unauthenticated remote attacker can send an unlimited number of authentication requests to the vulnerable system, leading to resource exhaustion (DoS) or — through brute-force techniques — to disclosure of sensitive information. The absence of an account locking mechanism or request rate limiting enables the attack to be carried out without any privileges and without user interaction.

An attacker can cause service unavailability (DoS) or gain access to sensitive information processed by IBM App Connect Enterprise, compromising the integrity and confidentiality of organizational data.

Apply patches available from the vendor in accordance with the references (https://www.ibm.com/support/pages/node/7108661). It is recommended to update to versions outside the vulnerable ranges indicated by IBM.

IBM App Connect Enterprise in versions 11.0.0.1 to 11.0.0.24 and 12.0.1.0 to 12.0.11.0