Lucene search

IBMAFC238A345358DBC38B756077C169FC7FF809F8A55F1D67CE811A48B17152F1A

HistoryMar 22, 2023 - 10:43 p.m.

Security Bulletin: Watson CP4D Data Stores for Cloud Pak for Data does not encypt sensitive information before storage or transmission (CVE-2023-27291)

2023-03-2222:43:40

www.ibm.com

ibm

watson

cp4d

data stores

cloud pak for data

encryption

sensitive information

transmission

cve-2023-27291

vulnerability

fix

upgrade

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

EPSS

Percentile

9.0%

JSON

Summary

IBM Watson CP4D Data Stores does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information.

Vulnerability Details

CVEID:CVE-2023-27291
**DESCRIPTION:**IBM Watson CP4D Data Stores does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information.
CVSS Base score: 4.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/248740 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
Watson CloudPak for Data Data Stores	4.6.0,4.6.1, 4.6.2, 4.6.3

Remediation/Fixes

Install CP4D services containing Watson CloudPak for Data Data Stores to version 4.6.4 or later

<https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=assistant-upgrading>

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwatson_developer_cloudMatch4.6.0

ibmwatson_developer_cloudMatch4.6.1

ibmwatson_developer_cloudMatch4.6.2

ibmwatson_developer_cloudMatch4.6.3

VendorProductVersionCPE
ibmwatson_developer_cloud4.6.0cpe:2.3:a:ibm:watson_developer_cloud:4.6.0:*:*:*:*:*:*:*
ibmwatson_developer_cloud4.6.1cpe:2.3:a:ibm:watson_developer_cloud:4.6.1:*:*:*:*:*:*:*
ibmwatson_developer_cloud4.6.2cpe:2.3:a:ibm:watson_developer_cloud:4.6.2:*:*:*:*:*:*:*
ibmwatson_developer_cloud4.6.3cpe:2.3:a:ibm:watson_developer_cloud:4.6.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	watson_developer_cloud	4.6.0	cpe:2.3:a:ibm:watson_developer_cloud:4.6.0:::::::*
ibm	watson_developer_cloud	4.6.1	cpe:2.3:a:ibm:watson_developer_cloud:4.6.1:::::::*
ibm	watson_developer_cloud	4.6.2	cpe:2.3:a:ibm:watson_developer_cloud:4.6.2:::::::*
ibm	watson_developer_cloud	4.6.3	cpe:2.3:a:ibm:watson_developer_cloud:4.6.3:::::::*