SB2023091820 - Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
Published: September 18, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Incorrect default permissions (CVE-ID: CVE-2021-3701)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.
2) Race condition (CVE-ID: CVE-2021-3702)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
3) OS Command Injection (CVE-ID: CVE-2021-4041)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper input validation in the ansible_runner.interface.run_command. A local user can pass specially crafted parameters to the command that get executed on the host operating system instead of the guest OS.
4) Improper Handling of Parameters (CVE-ID: CVE-2022-3697)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote user can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.