IBM OpenPages with Watson Information Disclosure Vulnerability

An information disclosure vulnerability has been identified in IBM OpenPages with Watson versions 8.3 and 9.0. This vulnerability arises from insufficient security on certain REST endpoints used for administration, allowing authenticated users to access sensitive information about system configuration and internal state, which is intended only for administrators.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system information, potentially allowing users to gain insights into system configuration and internal processes that could be misused.

Remediation

Users of IBM OpenPages 9.0 should upgrade to version 9.0.0.5 and then apply Interim Fix 3. Users of IBM OpenPages 8.3 should upgrade to version 8.3.0.3 and then apply Interim Fix 2. Instructions for downloading these versions are available on the IBM Support website.