IBM DataStage on Cloud Pak for Data Command Injection Vulnerability

A command injection vulnerability has been identified in IBM DataStage on Cloud Pak for Data, affecting versions 5.1.2 through 5.3.0. This vulnerability allows authenticated users to execute arbitrary commands with normal user privileges on the system. The issue arises from improper validation of user-supplied input in the user-defined function component, which can be exploited to inject and execute malicious commands.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the system, potentially allowing for further exploitation or manipulation of the environment.

Remediation

Users are advised to upgrade to version 5.3.1 or later. Instructions for upgrading can be found in the IBM Cloud Pak for Data documentation.