Arbitrary file upload in Cloud Pak for Data - CVE-2022-36769
Published: October 24, 2023
Vulnerability identifier: #VU82318
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-36769
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload. A remote privileged user can upload a malicious file and execute it on the server.
Affected software
Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
How to mitigate CVE-2022-36769
Install updates from vendor's website.
Cloud Pak for Data - update to 4.6.4
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.6.4
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.6.4