Command injection in IBM Watson Assistant for IBM Cloud Pak for Data

1) Command Injection

EUVDB-ID: #VU88462

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27980

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper handling of batch files in child_process.spawn / child_process.spawnSync. An attacker can inject a malicious command line argument and achieve code execution even if the shell option is not enabled.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Assistant for IBM Cloud Pak for Data: before 5.0

CPE2.3

External links

http://www.ibm.com/support/pages/node/7158299

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.