5.3
Medium
CVE-2024-49780 IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system
Description
IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenPages with Watson | 9.0 | No fix stated |
| OpenPages with Watson | 8.3 | No fix stated |
Other CVEs of OpenPages with Watson
The 20 CVEs of OpenPages with Watson →
CVE-2025-1112
IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only…
4.3
Medium
CVE-2025-27369
IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to information disclosure of sensitive information due to a…
4.3
Medium
CVE-2025-27367
IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side…
5.3
Medium
CVE-2024-49783
IBM OpenPages with Watson 8.3 and 9.0
could provide weaker than expected security in storage of encrypted data
5.3
Medium