IBM App Connect Enterprise Certified Container Untrusted Search Path Vulnerability Allowing Access to Sensitive Files and Configuration Modifications

A vulnerability exists in IBM App Connect Enterprise Certified Container versions up to 12.19.0 (Continuous Delivery) and 12.0 LTS (Long Term Support). The issue arises from an untrusted search path, which could enable an attacker to access sensitive files or alter configurations. This vulnerability is linked to insufficient write protection for files within the mapping assistance image, potentially leading to a loss of confidentiality.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files or unauthorized modifications to configurations.

Remediation

Users are advised to upgrade to IBM App Connect Enterprise Certified Container Operator version 12.20.0 or higher for the Continuous Delivery release, and version 12.0.20 or higher for the Long Term Support release. Additionally, ensure that all DesignerAuthoring components are updated to version 13.0.6.1-r1 or higher for Continuous Delivery, and version 12.0.12-r20 or higher for Long Term Support. Documentation on the upgrade process is available on the IBM App Connect documentation site.