IBM TXSeries 9.1/11.1 Username Enumeration via Login Response
CVE-2024-56476 Published on April 2, 2025
IBM TXSeries for Multiplatforms information disclosure
IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy.
Vulnerability Analysis
CVE-2024-56476 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. This issue frequently occurs during authentication, where a difference in failed-login messages could allow an attacker to determine if the username is valid or not. These exposures can be inadvertent (bug) or intentional (design).
Products Associated with CVE-2024-56476
Want to know whenever a new CVE is published for IBM Txseries For Multiplatforms? stack.watch will email you.
Affected Versions
IBM TXSeries for Multiplatforms:- Version 9.1 is affected.
- Version 11.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.