Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

2024-07-2921:55:33

www.ibm.com

ibm watson discovery

cloud pak for data

vulnerability

node.js

remote attack

cveid

cvss

icp discovery

upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.8

Confidence

High

JSON

Summary

IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js

Vulnerability Details

CVEID:CVE-2024-29896
**DESCRIPTION:**Node.js npm Astro-Shield module is vulnerable to script injection, caused by an error when automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users. A remote attacker could exploit this vulnerability to “allow-listing” malicious injected resources like inlined JS, or references to external malicious scripts by the CSP headers generation feature.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286851 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
ICP - Discovery	4.0.0 - 5.0.0

Remediation/Fixes

Upgrade to IBM Watson Discovery 5.0.1 and <https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install>

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwatson_discoveryMatch4.0.0

ibmwatson_discoveryMatch5.0.1

VendorProductVersionCPE
ibmwatson_discovery4.0.0cpe:2.3:a:ibm:watson_discovery:4.0.0:*:*:*:*:*:*:*
ibmwatson_discovery5.0.1cpe:2.3:a:ibm:watson_discovery:5.0.1:*:*:*:*:*:*:*