Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2025-24814 CVE-2024-52012 |
| CWE-ID | CWE-264 CWE-22 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Log Analysis Server applications / Other server solutions |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU103324
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-24814
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error when handling configuration files. Solr instances that use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
Install update from vendor's website.
Vulnerable software versionsLog Analysis: 1.3.5.3 - 1.3.8.1
CPE2.3- cpe:2.3:a:ibm_corporation:log_analysis:1.3.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm_corporation:log_analysis:1.3.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm_corporation:log_analysis:1.3.6.1:*:*:*:*:*:*:*
https://www.ibm.com/support/pages/node/7230830
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Path traversal
EUVDB-ID: #VU103325
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-52012
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to overwrite arbitrary files on the system.
The vulnerability exists due to input validation error when handling ZIP files passed via "configset upload" API. A remote user can upload a specially crafted ZIP archive and overwrite arbitrary files on the system (a.k.a. zipslip attack).
Install update from vendor's website.
Vulnerable software versionsLog Analysis: 1.3.5.3 - 1.3.8.1
CPE2.3- cpe:2.3:a:ibm_corporation:log_analysis:1.3.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm_corporation:log_analysis:1.3.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm_corporation:log_analysis:1.3.6.1:*:*:*:*:*:*:*
https://www.ibm.com/support/pages/node/7230830
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
