CVE-2024-56343
BaseFortify
Publication date: 2025-06-06
Last updated on: 2025-08-20
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | verify_identity_access_digital_credentials | 24.06 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-771 | The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2024-56343 is a vulnerability in IBM Verify Identity Access Digital Credentials version 24.06 that allows an authenticated user to crash the service by sending a specially crafted POST request. This issue is categorized under CWE-771 (Missing Reference to Active Allocated Resource) and results in an availability impact, meaning the service can be disrupted or made unavailable. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated user to crash the IBM Verify Identity Access Digital Credentials service, causing a denial of service. The impact is limited to availability, meaning the service could become temporarily unavailable or disrupted, potentially affecting users who rely on it. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for specially crafted POST requests sent by authenticated users that cause the IBM Verify Identity Access Digital Credentials 24.06 service to crash. Specific detection commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
IBM recommends updating to the latest software version of IBM Verify Identity Access Digital Credentials. The updated image can be obtained and deployed using the command: `docker pull icr.io/ivia/ivia-digital-credentials:latest`. No other workarounds or mitigations are provided. [1]