IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for Apache Commons IO



Published: 2023-01-15
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2021-29425
CWE-ID CWE-22
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
Server applications / Other server solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Path traversal

EUVDB-ID: #VU52252

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-29425

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error within the FileNameUtils.normalize method when processing directory traversal sequences, such as "//../foo", or "\..foo". A remote attacker can send a specially crafted request and verify files availability in the parent folder.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data : 4.0.0 - 4.0.5

External links

http://www.ibm.com/support/pages/node/6563317


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###