How severe is CVE-2024-39727?

CVE-2024-39727 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-39727 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-39727?

CVE-2024-39727 primarily affects Ibm Engineering Lifecycle Optimization - Engineering Insights. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-39727?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-39727 have an EU (EUVD) identifier?

Yes. CVE-2024-39727 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-38017.

When was CVE-2024-39727 published?

CVE-2024-39727 was published on 2024-12-25 and last updated on 2026-06-17.

CVE-2024-39727

CVE-2024-39727 is a medium-severity vulnerability in Ibm Engineering Lifecycle Optimization - Engineering Insights with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1022.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 0% (26th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-38017
Weakness: CWE-1022
Affected product: Ibm Engineering Lifecycle Optimization - Engineering Insights
Published: 2024-12-25
Last modified: 2026-06-17

Description

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.

Frequently asked questions

What is CVE-2024-39727?: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.
How severe is CVE-2024-39727?: CVE-2024-39727 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-39727 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-39727?: CVE-2024-39727 primarily affects Ibm Engineering Lifecycle Optimization - Engineering Insights. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-39727?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-39727 have an EU (EUVD) identifier?: Yes. CVE-2024-39727 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-38017.
When was CVE-2024-39727 published?: CVE-2024-39727 was published on 2024-12-25 and last updated on 2026-06-17.

References

https://www.ibm.com/support/pages/node/7176783

Affected products (2)

cpe:2.3:a:ibm:engineering_lifecycle_optimization_-_engineering_insights:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_lifecycle_optimization_-_engineering_insights:7.0.3:*:*:*:*:*:*:*

More vulnerabilities in Ibm Engineering Lifecycle Optimization - Engineering Insights

CVE-2020-4495 — High (CVSS 8.8): IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused…
CVE-2024-39726 — High (CVSS 8.2): IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity…
CVE-2021-20371 — Medium (CVSS 6.5): IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an…
CVE-2020-4732 — Medium (CVSS 6.5): IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due…
CVE-2020-4974 — Medium (CVSS 6.3): IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated…
CVE-2020-5004 — Medium (CVSS 5.4): IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…

All CVEs affecting Ibm Engineering Lifecycle Optimization - Engineering Insights →

Other CWE-1022 vulnerabilities

CVE-2022-1583 — Medium (CVSS 6.5): The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null"…
CVE-2020-36624 — Medium (CVSS 6.3): A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability…
CVE-2022-4927 — Medium (CVSS 5.5): A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some…
CVE-2025-33014 — Medium (CVSS 5.4): IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a…
CVE-2022-2600 — Medium (CVSS 5.4): The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which…
CVE-2025-59842 — Medium (CVSS 4.3): jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…

Browse all CWE-1022 vulnerabilities →