How severe is CVE-2024-52359?

CVE-2024-52359 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2024-52359 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-52359?

CVE-2024-52359 primarily affects Ibm Concert. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-52359?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-52359 have an EU (EUVD) identifier?

Yes. CVE-2024-52359 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-45994.

When was CVE-2024-52359 published?

CVE-2024-52359 was published on 2024-11-19 and last updated on 2026-06-17.

CVE-2024-52359

CVE-2024-52359 is a medium-severity vulnerability in Ibm Concert with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-286.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-45994
Weakness: CWE-286
Affected product: Ibm Concert
Published: 2024-11-19
Last modified: 2026-06-17

Description

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls.

Frequently asked questions

What is CVE-2024-52359?: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls.
How severe is CVE-2024-52359?: CVE-2024-52359 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2024-52359 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-52359?: CVE-2024-52359 primarily affects Ibm Concert. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-52359?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-52359 have an EU (EUVD) identifier?: Yes. CVE-2024-52359 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-45994.
When was CVE-2024-52359 published?: CVE-2024-52359 was published on 2024-11-19 and last updated on 2026-06-17.

References

https://www.ibm.com/support/pages/node/7176346

Affected products (4)

cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*

More vulnerabilities in Ibm Concert

CVE-2025-33015 — High (CVSS 8.8): IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file…
CVE-2025-12771 — High (CVSS 7.8): IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A…
CVE-2025-64645 — High (CVSS 7.7): IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a…
CVE-2024-52360 — High (CVSS 7.6): IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. A remote attacker could send…
CVE-2025-33090 — High (CVSS 7.5): IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially…
CVE-2025-33088 — High (CVSS 7.4): IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to…

All CVEs affecting Ibm Concert →

Other CWE-286 vulnerabilities

CVE-2025-64725 — Critical (CVSS 9.8): Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by…
CVE-2023-26689 — Critical (CVSS 9.8): An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted…
CVE-2025-7972 — Critical (CVSS 9.1): A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to…
CVE-2024-48853 — Critical (CVSS 9.0): An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as…
CVE-2026-35638 — High (CVSS 8.8): OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated…
CVE-2023-3932 — High (CVSS 8.2): An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions…

Browse all CWE-286 vulnerabilities →