IBM watsonx.data Inbound and Outbound Connection Restriction Vulnerability Allowing Unrestricted File Transfer or Modification

A vulnerability exists in IBM watsonx.data versions 2.2 through 2.3.1, specifically within IBM Lakehouse. The issue arises because the application does not properly restrict inbound and outbound connections, potentially allowing an attacker to transfer or modify files without any limitations.

Impact

Exploitation of this vulnerability could lead to unauthorized file transfers or modifications, allowing for potential data manipulation or disruption.

Remediation

Users are advised to upgrade to the latest available version of watsonx.data 2.3.x or watsonx.data on CPD 5.3.x. Installation or upgrade instructions can be found in the IBM watsonx Subscription support documentation.