CVE-2024-41786 PUBLISHED

IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure Rule

Assigner: ibm
Reserved: 22.07.2024 Published: 08.11.2026 Updated: 08.11.2026

IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor IBM
Product Engineering Requirements Management DOORS Next
Versions
  • Version 7.1 is affected
  • Version 7.2 is affected

Solutions

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now by taking the actions documented in this bulletin.

For IBM Engineering Requirements Management DOORS Next 7.1, install ifix 13 https://www.ibm.com/support/fixcentral/swg/downloadFixes  or newer.

For IBM Engineering Requirements Management DOORS Next 7.2, install ifix 05 https://www.ibm.com/support/fixcentral/swg/downloadFixes or newer.

References

Problem Types

  • CWE-213 Exposure of Sensitive Information Due to Incompatible Policies CWE