Lucene search

IBM4392547B785774FE9AE5A632B4118A241B21ACF551AB83B4051CA1A5B728E58F

HistoryJan 12, 2023 - 9:59 p.m.

Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-23181)

2023-01-1221:59:00

www.ibm.com

apache tomcat

ibm watson speech services

cloud pak for data

vulnerabilities

cve-2022-23181

local authenticated attacker

elevated privileges

upgrade

version 4.0.8

CVSS2

3.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

9.7%

JSON

Summary

Vulnerabilities in Apache Tomcat affect IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-23181). Please see below for details on how to remdiate this issue.

Vulnerability Details

**CVEID:**CVE-2022-23181 DESCRIPTION: Apache Tomcat could allow a local authenticated attacker to gain elevated privileges on the system, caused by a time of check, time of use flaw when configured to persist sessions using the FileStore. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to perform actions with the privileges of Tomcat process.
CVSS Base score: 7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218221 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data	4.0.0 - 4.0.7

Remediation/Fixes

Please upgrade to IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data, version 4.0.8

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmibm_speech_to_text_for_ibm_cloudMatch4.0.0

ibmibm_speech_to_text_for_ibm_cloudMatch4.0.7

VendorProductVersionCPE
ibmibm_speech_to_text_for_ibm_cloud4.0.0cpe:2.3:a:ibm:ibm_speech_to_text_for_ibm_cloud:4.0.0:*:*:*:*:*:*:*
ibmibm_speech_to_text_for_ibm_cloud4.0.7cpe:2.3:a:ibm:ibm_speech_to_text_for_ibm_cloud:4.0.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	ibm_speech_to_text_for_ibm_cloud	4.0.0	cpe:2.3:a:ibm:ibm_speech_to_text_for_ibm_cloud:4.0.0:::::::*
ibm	ibm_speech_to_text_for_ibm_cloud	4.0.7	cpe:2.3:a:ibm:ibm_speech_to_text_for_ibm_cloud:4.0.7:::::::*