XXE in IBM Watson Assistant for IBM Cloud Pak for Data

1) XML External Entity injection

EUVDB-ID: #VU48979

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-25649

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to modify information on the system.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and modify information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Assistant for IBM Cloud Pak for Data: before 4.0.0

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_assistant_for_ibm_cloud_pak_for_data:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-with-fasterxml-jackson-databind-3/
https://www.ibm.com/support/pages/node/6476332

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.