SB2024091626 - Multiple vulnerabilities in IBM Watson Discovery

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024091626

SB2024091626 - Multiple vulnerabilities in IBM Watson Discovery

Published: September 16, 2024

Security Bulletin ID SB2024091626
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Prototype pollution (CVE-ID: CVE-2024-38999)

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to prototype pollution via the function s.contexts._.configure. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.


2) Prototype pollution (CVE-ID: CVE-2024-38998)

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to prototype pollution via the function config. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in arbitrary code execution or denial of service (DoS).


Remediation

Install update from vendor's website.

References