Security Bulletin: Vulnerability affects IBM Watson Assistant for IBM Cloud Pak for Data

Summary

DOM-based vulnerability affects IBM Watson ™ Assistant for IBM Cloud Pak for Data. A DOM-based, cross-site scripting vulnerability was found in the admin console where user input was not validated correctly. An authenticated user could exploit the flaw by injecting JavaScript code into the application in a request, and the payload would be stored. Subsequent navigation to the affected pages would result in the code being executed in the browser.

Vulnerability Details

CVEID:CVE-2019-4428
**DESCRIPTION:**IBM WDC - Watson Assistant is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162807 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Upgrade to IBM Watson Assistant for IBM Cloud Pak for Data 1.4.0. To download the software, go to Passport Advantage, then search for “watson assistant cloud pak data”. Select either IBM Watson Assistant for IBM Cloud Pak for Data Installation Packages Linux English eAssembly, part number CC4F1EN, or IBM Watson Assistant for IBM Cloud Pak for Data Add-on V1.4.0, part number CJ6I6EN. Installation instructions for IBM Watson Assistant for IBM Cloud Pak for Data 1.4.0 can be found at <https://cloud.ibm.com/docs/services/assistant-data?topic=assistant-data-install-140&gt;

Workarounds and Mitigations

None