CVE-2024-47106: IBM Jazz Information Disclosure Flaw

CVE-2024-47106 Overview

CVE-2024-47106 affects IBM Jazz for Service Management versions 1.1.3 through 1.1.3.22. The vulnerability allows a remote unauthenticated attacker to obtain sensitive information due to improper access restrictions in the application. Disclosed data can support reconnaissance and enable follow-on attacks against the affected system.

The weakness is classified as [CWE-552] (Files or Directories Accessible to External Parties). IBM published a security bulletin acknowledging the issue and provided updated guidance for affected deployments.

Critical Impact
A network-based attacker without credentials or user interaction can retrieve confidential data from vulnerable IBM Jazz for Service Management instances, weakening downstream security controls.

Affected Products

IBM Jazz for Service Management 1.1.3
IBM Jazz for Service Management versions 1.1.3.1 through 1.1.3.22
Deployments exposing the Jazz for Service Management web interface to untrusted networks

Discovery Timeline

2025-01-18 - CVE-2024-47106 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47106

Vulnerability Analysis

IBM Jazz for Service Management is an integration platform that supports IBM Tivoli Netcool/OMNIbus, Tivoli Network Manager, and related operations management products. The platform exposes web-based interfaces for dashboards, reporting, and administration.

CVE-2024-47106 stems from improper access restrictions on resources served by the application. A remote attacker can issue crafted requests to the affected endpoints and retrieve sensitive information that should require authentication or stricter authorization. The disclosed data can include configuration details, internal references, or other artifacts useful in attack planning.

The vulnerability is network-reachable, requires no privileges, and requires no user interaction. Only confidentiality is impacted; integrity and availability remain unaffected. The EPSS probability is approximately 0.39% (30.58 percentile), indicating low observed exploitation likelihood at this time.

Root Cause

The root cause is improper enforcement of access control on files or resources made available through the Jazz for Service Management interface, consistent with [CWE-552]. Resources expected to be restricted are reachable without sufficient authorization checks, exposing sensitive content to unauthenticated callers.

Attack Vector

An attacker sends HTTP requests over the network to a vulnerable Jazz for Service Management instance. The requests target resources that lack proper access restrictions, and the server returns sensitive content in the response. No authentication, privileges, or user interaction are required. The vulnerability is described in IBM's advisory in prose; no public proof-of-concept code is referenced in the enriched data.

Detection Methods for CVE-2024-47106

Indicators of Compromise

Unauthenticated HTTP requests to Jazz for Service Management endpoints returning non-empty responses with sensitive content
Repeated access to administrative or configuration paths from external or unusual source IP addresses
Web server logs showing successful (HTTP 200) responses to resources that normally require authentication

Detection Strategies

Review web access logs for anomalous request patterns targeting Jazz for Service Management URIs from unauthenticated sessions
Correlate outbound data volume from the Jazz application server against historical baselines to identify anomalous information retrieval
Inspect application logs for resource access without an associated authenticated user identifier

Monitoring Recommendations

Enable verbose access logging on the Jazz for Service Management web tier and forward logs to a central SIEM
Alert on bursts of requests from a single source IP enumerating Jazz application paths
Track changes in response sizes for sensitive endpoints to identify probing or scraping activity

How to Mitigate CVE-2024-47106

Immediate Actions Required

Identify all Jazz for Service Management instances at versions 1.1.3 through 1.1.3.22 and inventory their exposure
Apply the remediation referenced in the IBM Support Page according to the vendor's instructions
Restrict network access to the Jazz for Service Management web interface to trusted management networks until patched

Patch Information

IBM has published guidance for this vulnerability on its support portal. Administrators should consult the IBM Support Page for the affected fix levels, interim fixes, and any prerequisite steps required for IBM Jazz for Service Management deployments.

Workarounds

Place the Jazz for Service Management interface behind a reverse proxy enforcing authentication and source IP allow-listing
Restrict access through firewall rules so only authorized administrative networks can reach the application
Disable or block external access to non-essential endpoints exposed by the Jazz application until the patch is applied

bash

# Example: restrict access to Jazz for Service Management at the network layer
# Replace 10.10.0.0/24 with your trusted admin network and update interface as needed
iptables -A INPUT -p tcp --dport 16310 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16310 -j DROP