TI-2024-28851 Aliases CVE-2024-43189 GHSA-5g3c-2wf5-mp5m

IBM Concert Software information disclosure

LOW 26CWE-327Published 2024-11-15 · Updated 2024-11-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-327.

Summary

IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0027 19th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Concert Software	1.0.0, 1.0.1	—	No fix listed	CNA

Concert Software VendorIBM Affected 1.0.0, 1.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:concert:1.0.0:::::::*	1.0.0	Vulnerable	IBM
cpe:2.3:a:ibm:concert:1.0.1:::::::*	1.0.1	Vulnerable	IBM

cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·IBM
cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-43189
2026-10-03 Alias added: GHSA-5g3c-2wf5-mp5m

References

Advisory 1

https://www.ibm.com/support/pages/node/7173596

TI-2026-05889 Multiple Vulnerabilities in IBM Concert Software CVSS 3.1CRITICAL 9.8
TI-2026-06070 Multiple Vulnerabilities in IBM Concert Software CVSS 3.1CRITICAL 9.8
TI-2026-05896 Multiple Vulnerabilities in IBM Concert Software CVSS 3.1CRITICAL 9.8
TI-2026-03128 Multiple Vulnerabilities in IBM Concert Software CVSS 3.1CRITICAL 9.1
TI-2025-24073 Multiple Vulnerabilities in IBM Concert Software. CVSS 3.1CRITICAL 9.8
TI-2026-14345 Multiple Vulnerabilities in IBM Concert Software CVSS 3.1CRITICAL 9.6

See all 91 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences