Multiple vulnerabilities in IBM License Metric Tool

1) Improper input validation

EUVDB-ID: #VU98648

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21217

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU105452

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-27152

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper authentication

EUVDB-ID: #VU103771

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-12797

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when using RFC7250 Raw Public Keys (RPKs) to authenticate a server. TLS and DTLS connections using raw public keys are vulnerable to man-in-middle attacks when server authentication failure is not detected by clients.

Note, the vulnerability can be exploited only when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer overflow

EUVDB-ID: #VU101344

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-10917

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to return of an incorrect value which has wrapped around by the JNI function GetStringUTFLength. A remote attacker can pass specially crafted data to the application, trigger integer overflow and bypass security restrictions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper input validation

EUVDB-ID: #VU98647

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21208

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper input validation

EUVDB-ID: #VU98645

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21210

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper input validation

EUVDB-ID: #VU98644

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21235

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Output Neutralization for Logs

EUVDB-ID: #VU105795

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-27111

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

Exploit availability: No

Description

The vulnerability allows a remote attacker to manipulate log entries.

The vulnerability exists due to improper input validation of the X-Sendfile-Type header in Rack::Sendfile when handling. A remote attacker can send specially crafted data containing newline characters via the affected header and manipulate log files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Cross-site scripting

EUVDB-ID: #VU105862

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-57965

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Inefficient regular expression complexity

EUVDB-ID: #VU101895

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-52798

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Inefficient regular expression complexity

EUVDB-ID: #VU98132

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45296

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) CRLF injection

EUVDB-ID: #VU105794

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-25184

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to manipulate data log entries.

The vulnerability exists due to insufficient validation of attacker-supplied data in Rack::CommonLogger. A remote user can pass specially crafted authorization credentials containing CR-LF characters to the Rack::Auth::Basic method, which stores this info into the to the env['REMOTE_USER'] variable. If the application accepts CR-LF characters in user name, a remote user can manipulate data log entries.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM License Metric Tool: 9.2.0 - 9.2.38

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_license_metric_tool:9.2.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7186586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.