PT-2023-13496 · Ibm · Ibm Cloud Pak For Data

Andreas Pfefferle + 1 · Publicado 2023-04-26 · Atualizado 2023-05-04 · CVE-2022-36769

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data versions 4.5 through 4.6

Description The issue allows a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment.

Recommendations For versions 4.5 and 4.6, consider restricting file upload capabilities to prevent the processing of malicious files until a patch is available. As a temporary workaround, limit the privileges of users who can upload files to minimize the risk of exploitation.

Correção

Command Injection

Unrestricted File Upload

Enumeração de Fraquezas

CWE-77

CWE-434

Identificadores relacionados

CVE-2022-36769

Produtos afetados

Ibm Cloud Pak For Data

Referências · 6

• https://t.me/cibsecurity/62886 · Publicação no Telegram
• https://ibm.com/support/pages/node/6980959 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-36769 · Nota de Segurança
• https://t.me/cvenotify/49084 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-36769 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/232034 · Aviso do Fabricante