EUVD-2026-70742
GHSA-fm22-x7f3-gcr6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects the prerequisite of bucket-name discovery and registration in a separate AWS account; C and I both Low as described; no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.
AnalysisAI
IBM Netezza Software 11.3.0.3 through Interim Fix 002 omits the AWS S3 ExpectedBucketOwner validation parameter on S3 API calls, leaving the application blind to bucket ownership. An unauthenticated remote attacker who registers an S3 bucket with a name matching or colliding with the target environment's configured bucket can intercept outbound data writes or inject crafted data into Netezza's S3-backed workflows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker identify or predict the name of an S3 bucket configured for use by IBM Netezza Software, and successfully register a bucket with that same name in a different AWS account - achievable if the bucket was previously deleted (bucket squatting) or if a naming collision exists across AWS regions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5) overstates ease of exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch detailed in the IBM support advisory at https://www.ibm.com/support/pages/node/7284359; the advisory provides fix instructions though the exact patched release version is not specified in the available data and should be confirmed directly with IBM. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Netezza Software
View allHardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret direct
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connection
Log injection in IBM Netezza Software 11.3.0.3 through Interim Fix 002 allows unauthenticated remote attackers to insert
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 (CWE-297) exposes encrypted
Same weakness CWE-283 – Unverified Ownership
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today