Lucene search

IBM706875AD11613DED9BE174905F9BF8958B79BE776E69C9B89D0D45A6E3ACA122

HistoryJun 05, 2024 - 8:42 p.m.

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in IBM WebSphere

2024-06-0520:42:48

www.ibm.com

ibm watson discovery

cloud pak for data

vulnerability

ibm websphere

security bulletin

upgrade

version 4.8.4

tls connections

cvss 5.3

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

Percentile

9.0%

JSON

Summary

IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of IBM WebSphere.

Vulnerability Details

CVEID:CVE-2023-50312
**DESCRIPTION:**IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/274711 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
ICP - Discovery	4.0.0-4.8.3

Remediation/Fixes

Upgrade to IBM Watson Discovery 4.8.4

<https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install>

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwatson_discoveryMatch4.0.0

ibmwatson_discoveryMatch4.8.3

VendorProductVersionCPE
ibmwatson_discovery4.0.0cpe:2.3:a:ibm:watson_discovery:4.0.0:*:*:*:*:*:*:*
ibmwatson_discovery4.8.3cpe:2.3:a:ibm:watson_discovery:4.8.3:*:*:*:*:*:*:*