{"id":"CVE-2024-35154","aliases":["EUVD-2024-35213","GHSA-p6pr-8hcj-hmv4"],"status":"published","title":"IBM WebSphere Application Server code execution","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01163,"percentile":0.67499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-250"],"published":"2024-07-09T21:57:32Z","modified":"2026-06-17T07:34:27Z","products":[{"vendor":"ibm","product":"websphere application server"},{"vendor":"ibm","product":"websphere_application_server"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7159825","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/292641","tags":["vdb-entry","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35154"},{"url":"https://github.com/advisories/GHSA-p6pr-8hcj-hmv4"}],"sources":{"cve":[{"id":"CVE-2024-35154","title":"IBM WebSphere Application Server code execution","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.","status":"published","published":"2024-07-09T21:57:32.82Z","modified":"2024-08-02T03:07:46.791Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-35213","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.","status":"published","published":"2024-07-09T21:57:32Z","modified":"2024-08-02T03:07:46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-p6pr-8hcj-hmv4","title":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has...","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.","status":"published","published":"2024-07-10T00:30:41Z","modified":"2024-07-10T00:30:42Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:57:40.937292Z"}],"nvd":[{"id":"CVE-2024-35154","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code.  Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  292641.","status":"published","published":"2024-07-09T22:15:02.227Z","modified":"2026-06-17T07:34:27.297Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:10:12.016585Z"}]}}