Security Bulletin: Vulnerability exists in Watson Explorer (CVE-2021-22096)

Summary

Security vulnerability in Spring Framework affects IBM Watson Explorer. IBM Watson Explorer has addressed the vulnerability.

Vulnerability Details

CVEID:CVE-2021-22096
**DESCRIPTION:**VMware Spring Framework could allow a remote attacker to bypass security restrictions. By sending a specially-crafted input, an attacker could exploit this vulnerability to cause the insertion of additional log entries.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/212430 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

12.0.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2,

12.0.3.0 - 12.0.3.8

IBM Watson Explorer Deep Analytics Edition Analytical Components|

12.0.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2,

12.0.3.0 - 12.0.3.8

IBM Watson Explorer Foundational Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 - 11.0.2.12
IBM Watson Explorer Analytical Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 - 11.0.2.12

Remediation/Fixes

12.0.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.8

|

Upgrade to Version 12.0.3.9.

See Watson Explorer Version 12.0.3.9 Foundational Components for download information and instructions.

IBM Watson Explorer Deep Analytics Edition Analytical Components| 12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.8|

Upgrade to Version 12.0.3.9.

See Watson Explorer Version 12.0.3.9 Analytical Components for download information and instructions.

IBM Watson Explorer
Foundational Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 -
11.0.2.12|

Upgrade to Version 11.0.2.13.

See Watson Explorer Version 11.0.2.13 Foundational Components for download information and instructions.

IBM Watson Explorer Analytical Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 -
11.0.2.12|

Upgrade to Version 11.0.2.13.

See Watson Explorer Version 11.0.2.13 Analytical Components for download information and instructions.

Workarounds and Mitigations

None