IBM5A03ACC4EE458E72F2B6F1603F33343C1261EA5F582F33564953834DA6DF543ASecurity Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Ansible
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
32.4%
Summary
IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Ansible.
Vulnerability Details
CVEID:CVE-2021-4041
**DESCRIPTION:**Ansible Runner could allow a local authenticated attacker to execute arbitrary code on the system, caused by improper shell escaping of the shell command. By sending a specially-crafted request using the ansible_runner.interface.run_command, an attacker could exploit this vulnerability to execute arbitrary code on the host system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/234439 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Watson Discovery | 4.0.0-4.5.3 |
Remediation/Fixes
Upgrade to IBM Watson Discovery 4.6.0
<https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install>
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| watson discovery | eq | 4.0.0 | |
| watson discovery | eq | 4.5.3 |
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
32.4%