Security Bulletin: Vulnerability in Apache Derby affects watsonx.data

2024-09-0422:12:59

www.ibm.com

apache derby

watsonx.data

bypass security restrictions

sensitive data

ldap injection

cve-2022-46337

remote attacker

database functions

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

Low

JSON

Summary

Apache Derby could allow a remote attacker to bypass security restrictions to view and corrupt sensitive data and run sensitive database functions and procedures. This can affect watsonx.data.

Vulnerability Details

CVEID:CVE-2022-46337
**DESCRIPTION:**Apache Derby could allow a remote attacker to bypass security restrictions, caused by a LDAP injection vulnerability in authenticator. By sending a specially crafted request, an attacker could exploit this vulnerability to view and corrupt sensitive data and run sensitive database functions and procedures.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/271915 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
watsonx.data	1.0.0 - 2.0.1

Remediation/Fixes

The product needs to be installed or upgraded to the latest available level watsonx.data 2.0.2 or watsonx.data on CPD 5.0.2. Installation/upgrade instructions can be found here: <https://www.ibm.com/docs/en/watsonx/watsonxdata/2.0.x?topic=deployment-installing>.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmibm_watsonx_subscriptionMatch1.0.0

ibmibm_watsonx_subscriptionMatch2.0.1

VendorProductVersionCPE
ibmibm_watsonx_subscription1.0.0cpe:2.3:a:ibm:ibm_watsonx_subscription:1.0.0:*:*:*:*:*:*:*
ibmibm_watsonx_subscription2.0.1cpe:2.3:a:ibm:ibm_watsonx_subscription:2.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	ibm_watsonx_subscription	1.0.0	cpe:2.3:a:ibm:ibm_watsonx_subscription:1.0.0:::::::*
ibm	ibm_watsonx_subscription	2.0.1	cpe:2.3:a:ibm:ibm_watsonx_subscription:2.0.1:::::::*