EUVD-2026-75782
GHSA-c7xh-jc58-j78w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Low-privilege authenticated user exploits IDOR over network with no interaction; scope changes to peer tenants' confidential log data, pure read-only impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL - pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.
AnalysisAI
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at minimum a low-privilege user account (PR:L) in an IBM DataStage on Cloud Pak for Data 5.4.0.0 deployment that hosts multiple tenants on a shared /ds-storage PVC. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 with AV:N/AC:L/PR:L/UI:N/S:C/C:H correctly captures the cross-tenant confidentiality threat: a low-privilege authenticated user with no elevated access can reach another tenant's logs over the network with no special exploitation technique - even a mid-sized municipal IT team in gniezno running a shared Cloud Pak for Data deployment should treat this as urgent, because job logs in DataStage routinely contain decryptable credential material that could pivot the attacker to downstream data sources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch per IBM security advisory at https://www.ibm.com/support/pages/node/7286562; the advisory confirms a fix is available though the exact patched version is not specified in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: verify which DataStage instances run version 5.4.0.0 and identify tenant overlap on shared storage; check audit logs for unauthorized cross-tenant log access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbi
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt servi
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read se
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-l
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arb
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
Share
External POC / Exploit Code
Leaving vuln.today