Deserialization in Ibm Sterling_b2b_integrator
CVE-2024-31903
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary code on the system, caused by the deserialization of untrusted data.
Vulnerability class: Insecure Deserialization
EPSS: 0.010 (57.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ibm Sterling_b2b_integrator
- Ibm Sterling B2b Integrator Standard Edition — versions 6.0.0.0, 6.2.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@us.ibm.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-31903?
- CVE-2024-31903 is a high-severity vulnerability in Ibm Sterling_b2b_integrator, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2025-01-22.
- How severe is CVE-2024-31903?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-31903 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.