Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2024-32462 CVE-2024-42472 |
CWE-ID | CWE-88 CWE-61 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software |
watsonx Assistant for IBM Cloud Pak for Data Other software / Other software solutions |
Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU88827
Risk: Low
CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-32462
CWE-ID:
CWE-88 - Argument Injection or Modification
Exploit availability: No
DescriptionThe vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper input validation when handling CLI arguments in the RequestBackground portal. A malicious application can escape sandbox via a specially crafted arguments and execute arbitrary code on the system.
Install update from vendor's website.
Vulnerable software versionswatsonx Assistant for IBM Cloud Pak for Data: before 4.8.8
CPE2.3 External linkshttps://www.ibm.com/support/pages/node/7182531
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU96049
Risk: Low
CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-42472
CWE-ID:
CWE-61 - UNIX Symbolic Link (Symlink) Following
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a symlink following issue when mounting persistent directories. A local user can create a specially crafted symbolic link and escape sandbox.
Install update from vendor's website.
Vulnerable software versionswatsonx Assistant for IBM Cloud Pak for Data: before 4.8.8
CPE2.3 External linkshttps://www.ibm.com/support/pages/node/7182531
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.