PT-2023-5400 · Ibm · Ibm Watson Knowledge Catalog

Publicado 2023-07-10 · Atualizado 2023-07-13 · CVE-2023-28958

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Watson Knowledge Catalog on Cloud Pak for Data version 4.0

Description The issue is related to a lack of proper validation of CSV file contents, which could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted CSV file. This is caused by improper validation of csv file contents.

Recommendations For IBM Watson Knowledge Catalog on Cloud Pak for Data version 4.0, consider disabling the functionality that allows the upload and processing of CSV files until a patch is available. Restrict access to the system to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-1236

Identificadores relacionados

BDU:2023-06030

CVE-2023-28958

Produtos afetados

Ibm Watson Knowledge Catalog

Referências · 6

• https://bdu.fstec.ru/vul/2023-06030 · Nota de Segurança
• https://ibm.com/support/pages/node/7009747 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28958 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/251782 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-28958 · Aviso do Fabricante
• https://t.me/cibsecurity/66279 · Publicação no Telegram