EUVD-2026-70744
GHSA-q3q9-q5c6-hxfq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible unauthenticated logging path writes unsanitized input; impact is solely low-integrity log falsification with no confidentiality or availability effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
AnalysisAI
Log injection in IBM Netezza Software 11.3.0.3 through Interim Fix 002 allows unauthenticated remote attackers to insert arbitrary content into log files by supplying input containing special characters - such as CRLF sequences - that is written to logs without proper neutralization. The vulnerability (CWE-117) enables falsification of audit trails, potential SIEM-alert manipulation, and degradation of forensic fidelity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required beyond network reachability of the IBM Netezza Software instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 score appropriately reflects an impact confined to log integrity - confidentiality and availability are unaffected per the C:N/A:N metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix or updated interim fix identified in the IBM Support advisory at https://www.ibm.com/support/pages/node/7284359 - this is IBM's stated resolution. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Netezza Software
View allHardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret direct
IBM Netezza Software 11.3.0.3 through Interim Fix 002 omits the AWS S3 `ExpectedBucketOwner` validation parameter on S3
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connection
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 (CWE-297) exposes encrypted
Same weakness CWE-117 – Improper Output Neutralization for Logs
View allShare
External POC / Exploit Code
Leaving vuln.today