What’s Vulnerable › Vulnerabilities
CVE-2024-54176: IBM UrbanCode Deploy missing authentication
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-02-08 · updated 2026-06-17
- Weakness: CWE-306
Description
IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.
Affected products
- IBM DevOps Deploy: from 8.0.0.0 before 8.0.1.5; 8.1.0.0 — fixed in 8.0.1.5
- IBM UrbanCode Deploy: from 7.0.0.0 before 7.0.5.26; from 7.1.0.0 before 7.1.2.22; from 7.2.0.0 before 7.2.3.15; from 7.3.0.0 before 7.3.2.10 — fixed in 7.0.5.26, 7.1.2.22, 7.2.3.15, 7.3.2.10
How to fix
Upgrade to a fixed version: IBM DevOps Deploy 8.0.1.5; IBM UrbanCode Deploy 7.0.5.26, 7.1.2.22, 7.2.3.15, 7.3.2.10. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-54176 or the next vulnerability affects your stack