IBM Powerha System Mirror vulnerabilities

2 CVEs affecting IBM Powerha System Mirror, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-55897, published 2025-01-03.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-5005, published 2015-11-08. High severity, CVSS 8.5. EPSS: 1.7% chance of exploitation in the next 30 days. CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list.
• CVE-2024-55897, published 2025-01-03. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to…