CVE-2024-38327 is a medium severity (CVSS 6.8) information exposure in IBM Analytics Content Hub 2.0, 2.1, 2.2 and 2.3. An exposed JavaScript source map helps an attacker read and debug the code behind the application's API. IBM's remediation is to move to IBM Cognos Analytics Content Hub 2.4.
What's affected
Per IBM's security bulletin, published July 9, 2025:
- IBM Analytics Content Hub 2.0 through 2.3: affected.
- Fix: IBM Cognos Analytics Content Hub 2.4.
- Workarounds and mitigations: none listed.
The same bulletin covers a second CVE for this product, a file upload weakness, so one upgrade handles both.
How to check if you're exposed
Open the product's about or administration page and read the version. For the Content Hub, compare it with 2.0 to 2.3 and confirm you are on 2.4 or later after the fix.
To see whether source maps are served, open the application in a browser, open the developer tools, and look at the Sources panel for files ending in .map. Source map files in production are what this CVE describes. Your own copy of the front end may also show a comment at the end of each script that points to its map.
What to do now
- Upgrade IBM Analytics Content Hub to 2.4 using IBM's instructions.
- Check whether any other internal web application serves .map files in production, and stop serving them.
- Restrict the Content Hub to the users who need it, and review the accounts that hold high privileges.
- Review API authorization on the server side, since a leaked map only helps an attacker who can also call the API.
Why it matters
The class is CWE-540, inclusion of sensitive information in source code. A source map links minified browser code back to the original readable files, including names and comments. Developers use it for debugging. Left on a production site, it gives an attacker a clear view of how the API works.
A source map does not break anything alone. It saves an attacker time. The CVSS vector asks for high privileges and user interaction, which explains the mid-range score. The fix for your own front ends is the same: do not publish source maps to production, or restrict them to internal tooling.
If you run your own web applications, check what a browser can download from them in production. Source maps, debug endpoints and leftover test files are common finds, and a scan of the live site or a review of the build output will list them.
Quick check
Is a source map exploitable by itself?
No. It reveals code structure and helps with further attacks, so the main protection is solid server-side authorization.
Sources
Last reviewed: 19 October 2026.
