CVE-2024-43190: IBM DOORS Information Disclosure Flaw

CVE-2024-43190 Overview

CVE-2024-43190 affects IBM Engineering Requirements Management DOORS version 9.7.2.9. Under certain configurations, a remote attacker can obtain password reset instructions of a legitimate user through man-in-the-middle (MITM) techniques. The weakness is categorized as [CWE-640] Weak Password Recovery Mechanism for Forgotten Password.

The flaw exposes confidential password reset data during transit. An attacker positioned between the user and the DOORS server can intercept these instructions and take over the targeted account. Exploitation requires specific configuration conditions and network positioning, which raises attack complexity.

Critical Impact
An attacker with network position can intercept password reset instructions and gain access to legitimate DOORS user accounts, leading to unauthorized access to requirements management data.

Affected Products

IBM Engineering Requirements Management DOORS 9.7.2.9
IBM Engineering Requirements Management DOORS Web Access 9.7.2.9
Deployments matching the vulnerable configuration described in the IBM advisory

Discovery Timeline

2025-07-07 - CVE-2024-43190 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43190

Vulnerability Analysis

CVE-2024-43190 stems from an insecure password recovery workflow in IBM Engineering Requirements Management DOORS 9.7.2.9. When the product is deployed under certain configurations, password reset instructions traverse the network in a form that an on-path adversary can capture. The weakness maps to [CWE-640], which covers weak password recovery mechanisms that allow account takeover through observable or predictable reset flows.

The vulnerability is remote and requires no authentication or user interaction. However, an attacker must occupy a privileged network position between the victim and the DOORS server, which raises attack complexity. Successful interception affects confidentiality only; integrity and availability of the system are not directly impacted by this issue.

DOORS is used by regulated industries to manage engineering requirements. Access to a legitimate account may expose intellectual property, safety-critical requirements, and traceability data. Additional details are available in the IBM Support Page.

Root Cause

The root cause is a password recovery flow that transmits or exposes reset instructions without adequate protection against interception. This aligns with [CWE-640], where the recovery mechanism itself becomes the attack surface rather than the authentication logic.

Attack Vector

An attacker performs a man-in-the-middle attack on the communication channel between the user and DOORS during a password reset. When the victim initiates the reset, the attacker intercepts the reset instructions and uses them to complete the password change or authenticate as the user. No prior credentials are needed.

No verified proof-of-concept code is publicly available for this issue. Refer to the IBM Support Page for vendor-provided technical detail.

Detection Methods for CVE-2024-43190

Indicators of Compromise

Password reset events for DOORS accounts followed by logins from unfamiliar IP addresses or geographies.
Successful authentications to DOORS shortly after a password reset that the legitimate user did not request.
Anomalous access to requirements projects immediately after a credential change.

Detection Strategies

Correlate DOORS password reset events with subsequent authentication and access activity to identify hijacked resets.
Inspect network paths between clients and DOORS servers for downgraded TLS, invalid certificates, or unexpected proxies.
Alert on password resets initiated from IPs that differ from the user's typical source ranges.

Monitoring Recommendations

Forward DOORS authentication, password reset, and administrative logs to a centralized SIEM for continuous review.
Monitor for repeated password reset requests targeting the same account within short time windows.
Track user-agent and source-IP deltas across reset and login pairs to surface account takeover attempts.

How to Mitigate CVE-2024-43190

Immediate Actions Required

Apply the fix described on the IBM Support Page for DOORS and DOORS Web Access 9.7.2.9.
Enforce TLS on all client-to-server DOORS communication and reject connections that fail certificate validation.
Review recent password reset activity and force re-authentication for accounts that reset credentials during the exposure window.

Patch Information

IBM has published remediation guidance for CVE-2024-43190 on the IBM Support Page. Administrators should follow the vendor's upgrade or configuration steps for IBM Engineering Requirements Management DOORS 9.7.2.9 and DOORS Web Access 9.7.2.9.

Workarounds

Restrict DOORS access to trusted network segments or require VPN access to reduce exposure to MITM positioning.
Configure the DOORS environment per IBM's hardening guidance so that the vulnerable configuration is not in effect.
Enable multi-factor authentication where supported so a captured reset alone does not grant account access.

bash

# Configuration example
# Verify TLS is enforced on the DOORS Web Access endpoint
curl -v --tlsv1.2 https://doors.example.local/dwa/ 2>&1 | grep -E 'SSL|TLS|certificate'

# Reject connections that fail certificate validation (client-side check)
openssl s_client -connect doors.example.local:443 -verify_return_error < /dev/null