How severe is CVE-2024-52890?

CVE-2024-52890 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-52890 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-52890?

CVE-2024-52890 primarily affects Ibm Engineering Lifecycle Optimization. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-52890?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-52890 have an EU (EUVD) identifier?

Yes. CVE-2024-52890 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54848.

When was CVE-2024-52890 published?

CVE-2024-52890 was published on 2025-08-05 and last updated on 2026-06-17.

CVE-2024-52890

CVE-2024-52890 is a medium-severity vulnerability in Ibm Engineering Lifecycle Optimization with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-84.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-54848
Weakness: CWE-84
Affected product: Ibm Engineering Lifecycle Optimization
Published: 2025-08-05
Last modified: 2026-06-17

Description

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs.

Frequently asked questions

What is CVE-2024-52890?: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs.
How severe is CVE-2024-52890?: CVE-2024-52890 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-52890 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-52890?: CVE-2024-52890 primarily affects Ibm Engineering Lifecycle Optimization. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-52890?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-52890 have an EU (EUVD) identifier?: Yes. CVE-2024-52890 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54848.
When was CVE-2024-52890 published?: CVE-2024-52890 was published on 2025-08-05 and last updated on 2026-06-17.

References

https://www.ibm.com/support/pages/node/7241392

Affected products (2)

cpe:2.3:a:ibm:engineering_lifecycle_optimization:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_lifecycle_optimization:7.0.3:*:*:*:*:*:*:*

More vulnerabilities in Ibm Engineering Lifecycle Optimization

CVE-2021-29844 — High (CVSS 8.8): IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated…
CVE-2023-45191 — High (CVSS 7.5): IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a…
CVE-2021-29774 — High (CVSS 7.5): IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain…
CVE-2021-29786 — Medium (CVSS 6.5): IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM…
CVE-2023-45187 — Medium (CVSS 6.3): IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which…
CVE-2021-29713 — Medium (CVSS 5.4): IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed…

All CVEs affecting Ibm Engineering Lifecycle Optimization →

Other CWE-84 vulnerabilities

CVE-2025-58444 — High (CVSS 8.6): The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported…
CVE-2025-25329 — Medium (CVSS 5.5): An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access…
CVE-2025-25334 — Medium (CVSS 5.5): An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via…
CVE-2025-25331 — Medium (CVSS 5.5): An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via…
CVE-2025-25330 — Medium (CVSS 5.5): An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via…
CVE-2025-25326 — Medium (CVSS 5.5): An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to…

Browse all CWE-84 vulnerabilities →