CVE-2024-38341

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38341", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-06-13T21:44:08.490Z", "datePublished": "2025-05-28T15:21:00.248Z", "dateUpdated": "2025-08-16T23:41:17.022Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:sterling_secure_proxy:6.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Sterling Secure Proxy", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.0.3.1", "status": "affected", "version": "6.0.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.0.1", "status": "affected", "version": "6.1.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.0.1", "status": "affected", "version": "6.2.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}], "value": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-328", "description": "CWE-328 Use of Weak Hash", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-16T23:41:17.022Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7234888"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Product Affected Version(s) Fixed-in Version(s) Remediation<br>IBM Sterling Secure Proxy 6.0.0.0 - 6.0.3.1 6.0.3.1 iFix 03<br>IBM Sterling Secure Proxy 6.1.0.0 - 6.1.0.1 6.1.0.1 iFix 03<br>IBM Sterling Secure Proxy 6.2.0.0 - 6.2.0.1 6.2.0.1 iFix 02"}], "value": "Product Affected Version(s) Fixed-in Version(s) Remediation\nIBM Sterling Secure Proxy 6.0.0.0 - 6.0.3.1 6.0.3.1 iFix 03\nIBM Sterling Secure Proxy 6.1.0.0 - 6.1.0.1 6.1.0.1 iFix 03\nIBM Sterling Secure Proxy 6.2.0.0 - 6.2.0.1 6.2.0.1 iFix 02"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Sterling Secure Proxy information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-28T15:51:17.148116Z", "id": "CVE-2024-38341", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-28T15:51:26.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38341", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-28T15:51:17.148116Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-28T15:51:21.340Z"}}], "cna": {"title": "IBM Sterling Secure Proxy information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:sterling_secure_proxy:6.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Sterling Secure Proxy", "versions": [{"status": "affected", "version": "6.0.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.3.1"}, {"status": "affected", "version": "6.1.0.0", "versionType": "semver", "lessThanOrEqual": "6.1.0.1"}, {"status": "affected", "version": "6.2.0.0", "versionType": "semver", "lessThanOrEqual": "6.2.0.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Product Affected Version(s) Fixed-in Version(s) Remediation\nIBM Sterling Secure Proxy 6.0.0.0 - 6.0.3.1 6.0.3.1 iFix 03\nIBM Sterling Secure Proxy 6.1.0.0 - 6.1.0.1 6.1.0.1 iFix 03\nIBM Sterling Secure Proxy 6.2.0.0 - 6.2.0.1 6.2.0.1 iFix 02", "supportingMedia": [{"type": "text/html", "value": "Product Affected Version(s) Fixed-in Version(s) Remediation<br>IBM Sterling Secure Proxy 6.0.0.0 - 6.0.3.1 6.0.3.1 iFix 03<br>IBM Sterling Secure Proxy 6.1.0.0 - 6.1.0.1 6.1.0.1 iFix 03<br>IBM Sterling Secure Proxy 6.2.0.0 - 6.2.0.1 6.2.0.1 iFix 02", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7234888", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.", "supportingMedia": [{"type": "text/html", "value": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "CWE-328 Use of Weak Hash"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-16T23:41:17.022Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38341", "state": "PUBLISHED", "dateUpdated": "2025-08-16T23:41:17.022Z", "dateReserved": "2024-06-13T21:44:08.490Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-05-28T15:21:00.248Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:sterling_secure_proxy:6.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Sterling Secure Proxy", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.0.3.1", "status": "affected", "version": "6.0.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.0.1", "status": "affected", "version": "6.1.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.0.1", "status": "affected", "version": "6.2.0.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sterling_secure_proxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C123481-383C-4001-B5DB-C0A31D48EDEA", "versionEndIncluding": "6.0.3.1", "versionStartIncluding": "6.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_secure_proxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE4CE662-8122-4C9E-992C-AA3E43D05460", "versionEndIncluding": "6.1.0.1", "versionStartIncluding": "6.1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_secure_proxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "739F6EB7-6130-4EAD-AF39-2D0F2249BCF9", "versionEndIncluding": "6.2.0.1", "versionStartIncluding": "6.2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}, {"lang": "es", "value": "IBM Sterling Secure Proxy 6.0.0.0 a 6.0.3.1, 6.1.0.0 a 6.1.0.0 y 6.2.0.0 a 6.2.0.1 utilizan algoritmos criptogr\u00e1ficos m\u00e1s d\u00e9biles de lo esperado que podr\u00edan permitir a un atacante descifrar informaci\u00f3n altamente confidencial."}], "id": "CVE-2024-38341", "lastModified": "2026-06-17T07:39:57.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38341", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-28T15:51:17.148116Z", "version": "2.0.3"}}]}, "published": "2025-05-28T16:15:32.847", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7234888"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-328"}], "source": "psirt@us.ibm.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-326"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}