IBM watsonx.data intelligence Plain Text Credential Storage Vulnerability

A vulnerability exists in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.3.0, and 5.3.1, where user credentials are stored in plain text, allowing local users to read them. This issue arises from improper input validation, leading to a prototype pollution vulnerability that can be exploited to modify the prototype of parsed YAML documents, potentially causing denial-of-service conditions or arbitrary file overwrites.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user credentials, with potential for further exploitation depending on the user's privileges.

Remediation

Users are advised to update to version 5.3.1-patch3. Instructions for downloading this patch are available on the IBM Software Hub.