CVE-2024-22349
Low
No strong exploitation signal.
CVSS base
4.0
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS — probability of exploitation (30 days)
0.2%
11.5th percentile
CISA KEV
Not listed
Weakness / dates
CWE-525
Published 2025-01-20 · modified 2026-07-27
CVSS breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | L | Local |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2025-01-20 — Published (NVD)
- 2026-07-27 — Last modified (NVD)
Description
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.