Main Vulnerability Database SB2022042119

SB2022042119 - Security restrictions bypass in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Published: April 21, 2022

Security Bulletin ID SB2022042119

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Security restrictions bypass (CVE-ID: CVE-2022-23181)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a time of check, time of use flaw when configured to persist sessions using the FileStore. A local user can perform certain actions which lead to security restrictions bypass and privilege escalation (code execution with Tomcat process privileges).

Remediation

Install update from vendor's website.

References

https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache-tomcat-affects-ibm-watson-speech-services-cartridge-for-ibm-cloud-pak-for-data/"
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache-tomcat-affects-ibm-watson-speech-services-cartridge-for-ibm-cloud-pak-for-data/</a>
https://www.ibm.com/support/pages/node/6573017