What’s Vulnerable › Vulnerabilities
CVE-2024-49779: IBM OpenPages cross-site request forgery
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-02-20 · updated 2026-06-17
- Weakness: CWE-352
Description
IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to bypass security restrictions, caused by improper validation and management of authentication cookies. By modifying the CSRF token and Session Id cookie parameters using the cookies of another user, a remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable application.
Affected products
- IBM OpenPages with Watson: from 8.3 before 8.3.0.3; from 9.0 before 9.0.0.5 — fixed in 8.3.0.3, 9.0.0.5
How to fix
Upgrade to a fixed version: IBM OpenPages with Watson 8.3.0.3, 9.0.0.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-49779 or the next vulnerability affects your stack