Datastage On Cloud Pak For Data
Monthly
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be triggered by a remote user who already holds valid platform credentials and supplies path traversal sequences to the product's file-handling logic, disrupting or halting the service. Exploitation requires an authenticated session with low privileges (CVSS vector PR:L) and no action by a victim, so the practical barrier is credential access rather than network reachability; availability is the realistic impact, with no evidence of code execution. A vendor patch is available via IBM support advisory node 7288649, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker holding a valid platform account to bypass intended directory restrictions and execute arbitrary code. Exploitation requires only low-privileged credentials (CVSS PR:L), needs no user interaction, and is network-reachable with low complexity, which is why the vector scores 9.9 Critical with a scope change (S:C) reflecting impact that can extend beyond the vulnerable component. Despite the high score, the practical risk picture is more moderate: EPSS is only 0.49% (40th percentile), CISA SSVC rates exploitation as none with automatable set to no, there is no public exploit code identified at time of analysis and no KEV listing, and the vendor has published a patch, so remediation is available rather than dependent on compensating controls alone.
Remote OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated attacker holding only low-privileged credentials to run arbitrary operating system commands on the underlying DataStage host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an OS command injection (CWE-78) in which specially crafted input is passed to a system command without proper neutralization, so no user interaction is required and a single crafted request over the network is sufficient once valid access is obtained. Exploitation is gated by the need for existing credentials on the instance, and there is no public exploit code identified at time of analysis; IBM has published a fix via support node 7288649.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who already holds valid low-privilege credentials (CVSS PR:L, AV:N, UI:N) to run arbitrary operating system commands on the underlying host, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The root cause is improper neutralization of special elements used in an OS command (CWE-94), meaning user-supplied input reaches a shell command without adequate sanitization. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), but a vendor patch is available per IBM's advisory, so unpatched 5.4.0.0 deployments exposed to multi-tenant users or broadly provisioned accounts should be prioritized for upgrade.
Man-in-the-middle interception of IBM DataStage on Cloud Pak for Data 5.4.0.0 client sessions lets an attacker who presents a forged TLS certificate capture the IAM bearer Authorization header that the session adapter attaches automatically, granting full platform-scope tenant API access to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. The root cause is CWE-295 improper certificate validation in client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor on the path between that machine and the Cloud Pak for Data platform - a co-tenant inside the shared cluster cannot exploit it - together with an active authenticated session that transmits a live token. CVSS 3.1 scores this 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N); no public exploit identified at time of analysis, and patch data indicates a fix is available from the vendor.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw in its archive extraction routine that lets a remote attacker with a valid authenticated account write files outside the intended destination directory and ultimately execute arbitrary code with the privileges of the affected service (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). The root cause is CWE-22 improper limitation of a pathname to a restricted directory, commonly known as an archive 'zip-slip' condition, where crafted entries in an uploaded archive escape the extraction root. Authentication is mandatory, so this is not an unauthenticated flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated in enterprise Cloud Pak for Data deployments where the attacker already holds platform credentials or a foothold.
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote user holding valid low-privileged credentials to reach files outside the directory the application intends to restrict, producing a high integrity impact (I:H) and a limited availability impact (A:L) while the published vector shows no direct confidentiality loss. Exploitation is remote (AV:N) but rated high complexity (AC:H), meaning success depends on target-specific conditions such as exact file paths or platform state, and it requires a valid account (PR:L) with no user interaction (UI:N). No public exploit code or CISA KEV entry was identified at time of analysis, so this is a real but moderate-priority flaw for unpatched 5.4.0.0 deployments; IBM has published a fix through its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a low-privileged user with network access to the service reach an unsafe deserialization sink and execute arbitrary code in the context of the affected component. The issue is CWE-502 (deserialization of untrusted data) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a successful attack yields high confidentiality, integrity and availability impact with no user interaction required. Exploitation requires previously obtained valid CP4D/DataStage credentials (PR:L) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none and the attack as not automatable, though the technical impact is rated total.
Authenticated command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker with valid low-privileged credentials to execute arbitrary operating-system commands, potentially compromising confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires network reachability to the DataStage/CP4D interface and the ability to supply input that is mapped into an unneutralized environment variable (CWE-78); no user interaction is needed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with total technical impact, so this is a genuine high-severity finding but not an emergency.
Server-side request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker to make the server issue requests to internal endpoints and return sensitive information by supplying a manipulated X-Forwarded-Proto header that the application fails to validate. Exploitation requires a valid account on the platform (CVSS PR:L) with network access to the DataStage web interface; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The vendor/NVD CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the independent assessment scores it C:H/I:N - a confidentiality-only SSRF whose real-world impact depends on which internal services the DataStage host can reach and what those endpoints expose.
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitrary operating system commands by exploiting a path traversal flaw (CWE-22). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a High severity score of 8.8, reflecting full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and a vendor patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, while a vendor patch is available.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary operating-system commands on the underlying host, fully compromising the confidentiality, integrity and availability of the affected deployment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms network reachability, low attack complexity, mandatory authentication at the low privilege level and no user interaction, matching the independent assessment that this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit code was identified at time of analysis, and a vendor patch is available through IBM support node 7288649; accordingly, real-world risk is concentrated in reachable, unpatched 5.4.0.0 deployments rather than in broad opportunistic exploitation.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
Credential disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated user recover encrypted credentials that were issued for other users or environments, because the product mishandles encrypted credential material. Exploitation is network-reachable and requires no user interaction, but it does require a valid low-privileged account on the deployment (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so the risk is a bounded confidentiality exposure that grows with the number of users and environments sharing the cluster rather than a remotely exploitable anonymous flaw; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). A vendor patch is available per IBM's advisory.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-privilege credentials run arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability impact. The flaw requires network reachability to the DataStage service but no user interaction and no non-default configuration, so any valid low-privilege account is sufficient to attempt exploitation; the platform is a specialized enterprise deployment typically placed behind organizational access controls rather than exposed to the internet. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), but a vendor patch is available per IBM's advisory, and the low attack complexity and high impact make prompt patching advisable.
Remote authenticated code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible because connector property values are not properly escaped when OSH scripts are generated, allowing an attacker with a valid account and the ability to define or edit connector properties to inject commands that execute with DataStage privileges. The flaw is network-reachable, low-complexity, and requires no victim interaction, but it requires authentication (CVSS 3.1 PR:L) and is rated 8.8 HIGH (C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and a vendor patch is available via IBM support.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-privilege credentials to execute arbitrary commands on the underlying system, with high impact to confidentiality, integrity, and availability. The flaw stems from improper neutralization of special elements used in OS commands (CWE-78), and exploitation requires a valid authenticated session plus reachability of the specific DataStage feature that passes user-supplied input into a shell command; no user interaction is needed. No public exploit code has been identified and there is no evidence of active exploitation (not listed in CISA KEV), but a vendor patch is available and the issue should be treated as a genuine high-priority fix rather than a high-CVSS-but-low-risk artifact.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only low-level privileges to execute arbitrary operating-system commands on the affected deployment, giving full compromise of host confidentiality, integrity and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid account and network reachability to the DataStage service, plus the ability to reach a parameter or job-input path whose value is passed into a shell command without neutralization; no user interaction is needed and complexity is rated low. At time of analysis no public exploit code and no confirmed active exploitation were identified, and IBM has published a vendor patch via its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who holds a valid, low-privileged account to inject and execute arbitrary operating system commands through the product's command-handling logic, giving full compromise of confidentiality, integrity, and availability on the affected deployment. The flaw is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and requires no user interaction, but it is gated behind authentication - making stolen credentials or a malicious insider the realistic threat model rather than anonymous internet-wide exploitation. A vendor patch is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated, low-privilege remote attacker to execute arbitrary operating system commands on the affected host, with full loss of confidentiality, integrity, and availability. Exploitation requires only valid credentials on the Cloud Pak for Data instance and network reachability to the vulnerable component (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8); it is not exploitable by unauthenticated users. No public exploit code has been identified at time of analysis, but IBM has published a vendor patch, and the low complexity of the flaw combined with high impact makes prompt upgrading advisable.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-privileged Cloud Pak for Data account execute arbitrary operating system commands on the affected node, resulting in full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) with a CVSS 3.1 base score of 8.8. Exploitation is network-reachable and low-complexity with no user interaction (AV:N/AC:L/PR:L/UI:N), but it is gated behind a valid authenticated account that can reach the DataStage service, so exposure is limited to authenticated users of the 5.4.0.0 build. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; a vendor patch is available, so patched deployments are not exposed.
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid account plant special elements in a DataStage input path that are passed unsanitized into an operating-system command, resulting in arbitrary command execution with the privileges of the DataStage service. The prerequisite is a legitimate authenticated session (CVSS PR:L) on a network-reachable instance (AV:N/AC:L, UI:N), which limits realistic exposure to authorized users, compromised credentials, or malicious insiders on unpatched 5.4.0.0 deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the vendor rates impact at 9.9 and a vendor patch is already available, so urgency is driven mainly by patch adoption rather than observed exploitation.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated low-privilege user who can route a path-traversal payload into a file-handling operation. The flaw is network-reachable with low attack complexity and no user interaction required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), leaving possession of a valid session as the primary barrier. Publicly available exploit code exists in the form of a published gist, but the issue is not in CISA KEV and EPSS sits at only 0.42% (35th percentile), with CISA SSVC rating exploitation as none and automatable as no - a contained, targeted-abuse risk rather than a mass-exploitation one.
Arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote, authenticated attacker to write files to attacker-chosen locations on the underlying host because user-supplied file paths are not properly validated (CWE-73). Exploitation requires valid DataStage credentials (CVSS PR:L, unauthenticated access is not sufficient) but no user interaction and no special conditions, and a successful write has high confidentiality, integrity, and availability impact, giving a base score of 8.8. No public exploit code has been identified at time of analysis, EPSS is 0.61% (48th percentile), and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is a real-but-not-urgent priority rather than an emergency.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.
An authenticated user of IBM DataStage on Cloud Pak for Data 5.4.0.0 can abuse path traversal (CWE-22) in file path handling to write to or delete arbitrary files on the platform's shared storage, compromising data integrity and availability for other jobs and tenants using that storage. The flaw is remotely reachable with a valid low-privileged account (CVSS 8.1, AV:N/PR:L, C:N/I:H/A:H) and a vendor patch is available from IBM; there is no CISA KEV listing and no confirmed public exploit, and EPSS is a modest 0.50% (41st percentile), indicating opportunistic rather than widespread exploitation pressure.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible low-privileged user to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any authenticated DataStage account - including data engineers or analysts, not just administrators - can trigger full confidentiality, integrity, and availability compromise of the affected component. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. IBM has released a patch, but no public exploit has been identified and no EPSS or KEV signal is present in the provided data.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to users who are not authorized to see it, letting an attacker who already holds a valid low-privilege account read data outside their intended scope over the network with no user interaction and low attack complexity. The independent assessment rates the flaw as confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so integrity and availability are not affected and the practical limiting factor is the requirement for authenticated access plus network reachability of the Cloud Pak for Data instance - this is not an anonymous, pre-authentication attack. The one caveat worth flagging is that IBM's own vector (9.6, S:C/I:H/I:H) asserts scope change and integrity impact that our assessment does not corroborate from the advisory text; there is no public exploit code and no CISA KEV entry, so there is no public exploit identified at time of analysis, and IBM has published a vendor advisory with patch guidance.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user to read sensitive data, because namespace-wide secrets are exposed through file mounts that are reachable from the DataStage workload. The vulnerability is rated CVSS 8.8 by the vendor, but our independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a confidentiality-only issue with a scope change, reflecting that the exposed secrets belong to other tenants/services in the same Kubernetes/OpenShift namespace rather than to the vulnerable component itself; the source vector's claims of high integrity and availability impact are not supported by the CWE-200 description. Exploitation requires a valid authenticated account on the affected 5.4.0.0 build and no user interaction; there is no public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided. Organizations running this release should treat any credentials present in the affected namespace as potentially compromised.
XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit identified at time of analysis.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the user-defined function component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the job subroutine component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system. [CVSS 6.5 MEDIUM]
Datastage On Cloud Pak For Data is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used to impersonate other users in the system. [CVSS 8.1 HIGH]
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be triggered by a remote user who already holds valid platform credentials and supplies path traversal sequences to the product's file-handling logic, disrupting or halting the service. Exploitation requires an authenticated session with low privileges (CVSS vector PR:L) and no action by a victim, so the practical barrier is credential access rather than network reachability; availability is the realistic impact, with no evidence of code execution. A vendor patch is available via IBM support advisory node 7288649, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker holding a valid platform account to bypass intended directory restrictions and execute arbitrary code. Exploitation requires only low-privileged credentials (CVSS PR:L), needs no user interaction, and is network-reachable with low complexity, which is why the vector scores 9.9 Critical with a scope change (S:C) reflecting impact that can extend beyond the vulnerable component. Despite the high score, the practical risk picture is more moderate: EPSS is only 0.49% (40th percentile), CISA SSVC rates exploitation as none with automatable set to no, there is no public exploit code identified at time of analysis and no KEV listing, and the vendor has published a patch, so remediation is available rather than dependent on compensating controls alone.
Remote OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated attacker holding only low-privileged credentials to run arbitrary operating system commands on the underlying DataStage host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an OS command injection (CWE-78) in which specially crafted input is passed to a system command without proper neutralization, so no user interaction is required and a single crafted request over the network is sufficient once valid access is obtained. Exploitation is gated by the need for existing credentials on the instance, and there is no public exploit code identified at time of analysis; IBM has published a fix via support node 7288649.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who already holds valid low-privilege credentials (CVSS PR:L, AV:N, UI:N) to run arbitrary operating system commands on the underlying host, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The root cause is improper neutralization of special elements used in an OS command (CWE-94), meaning user-supplied input reaches a shell command without adequate sanitization. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), but a vendor patch is available per IBM's advisory, so unpatched 5.4.0.0 deployments exposed to multi-tenant users or broadly provisioned accounts should be prioritized for upgrade.
Man-in-the-middle interception of IBM DataStage on Cloud Pak for Data 5.4.0.0 client sessions lets an attacker who presents a forged TLS certificate capture the IAM bearer Authorization header that the session adapter attaches automatically, granting full platform-scope tenant API access to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. The root cause is CWE-295 improper certificate validation in client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor on the path between that machine and the Cloud Pak for Data platform - a co-tenant inside the shared cluster cannot exploit it - together with an active authenticated session that transmits a live token. CVSS 3.1 scores this 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N); no public exploit identified at time of analysis, and patch data indicates a fix is available from the vendor.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw in its archive extraction routine that lets a remote attacker with a valid authenticated account write files outside the intended destination directory and ultimately execute arbitrary code with the privileges of the affected service (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). The root cause is CWE-22 improper limitation of a pathname to a restricted directory, commonly known as an archive 'zip-slip' condition, where crafted entries in an uploaded archive escape the extraction root. Authentication is mandatory, so this is not an unauthenticated flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated in enterprise Cloud Pak for Data deployments where the attacker already holds platform credentials or a foothold.
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote user holding valid low-privileged credentials to reach files outside the directory the application intends to restrict, producing a high integrity impact (I:H) and a limited availability impact (A:L) while the published vector shows no direct confidentiality loss. Exploitation is remote (AV:N) but rated high complexity (AC:H), meaning success depends on target-specific conditions such as exact file paths or platform state, and it requires a valid account (PR:L) with no user interaction (UI:N). No public exploit code or CISA KEV entry was identified at time of analysis, so this is a real but moderate-priority flaw for unpatched 5.4.0.0 deployments; IBM has published a fix through its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a low-privileged user with network access to the service reach an unsafe deserialization sink and execute arbitrary code in the context of the affected component. The issue is CWE-502 (deserialization of untrusted data) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a successful attack yields high confidentiality, integrity and availability impact with no user interaction required. Exploitation requires previously obtained valid CP4D/DataStage credentials (PR:L) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none and the attack as not automatable, though the technical impact is rated total.
Authenticated command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker with valid low-privileged credentials to execute arbitrary operating-system commands, potentially compromising confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires network reachability to the DataStage/CP4D interface and the ability to supply input that is mapped into an unneutralized environment variable (CWE-78); no user interaction is needed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with total technical impact, so this is a genuine high-severity finding but not an emergency.
Server-side request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker to make the server issue requests to internal endpoints and return sensitive information by supplying a manipulated X-Forwarded-Proto header that the application fails to validate. Exploitation requires a valid account on the platform (CVSS PR:L) with network access to the DataStage web interface; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The vendor/NVD CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the independent assessment scores it C:H/I:N - a confidentiality-only SSRF whose real-world impact depends on which internal services the DataStage host can reach and what those endpoints expose.
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitrary operating system commands by exploiting a path traversal flaw (CWE-22). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a High severity score of 8.8, reflecting full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and a vendor patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, while a vendor patch is available.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary operating-system commands on the underlying host, fully compromising the confidentiality, integrity and availability of the affected deployment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms network reachability, low attack complexity, mandatory authentication at the low privilege level and no user interaction, matching the independent assessment that this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit code was identified at time of analysis, and a vendor patch is available through IBM support node 7288649; accordingly, real-world risk is concentrated in reachable, unpatched 5.4.0.0 deployments rather than in broad opportunistic exploitation.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
Credential disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated user recover encrypted credentials that were issued for other users or environments, because the product mishandles encrypted credential material. Exploitation is network-reachable and requires no user interaction, but it does require a valid low-privileged account on the deployment (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so the risk is a bounded confidentiality exposure that grows with the number of users and environments sharing the cluster rather than a remotely exploitable anonymous flaw; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). A vendor patch is available per IBM's advisory.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-privilege credentials run arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability impact. The flaw requires network reachability to the DataStage service but no user interaction and no non-default configuration, so any valid low-privilege account is sufficient to attempt exploitation; the platform is a specialized enterprise deployment typically placed behind organizational access controls rather than exposed to the internet. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), but a vendor patch is available per IBM's advisory, and the low attack complexity and high impact make prompt patching advisable.
Remote authenticated code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible because connector property values are not properly escaped when OSH scripts are generated, allowing an attacker with a valid account and the ability to define or edit connector properties to inject commands that execute with DataStage privileges. The flaw is network-reachable, low-complexity, and requires no victim interaction, but it requires authentication (CVSS 3.1 PR:L) and is rated 8.8 HIGH (C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and a vendor patch is available via IBM support.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-privilege credentials to execute arbitrary commands on the underlying system, with high impact to confidentiality, integrity, and availability. The flaw stems from improper neutralization of special elements used in OS commands (CWE-78), and exploitation requires a valid authenticated session plus reachability of the specific DataStage feature that passes user-supplied input into a shell command; no user interaction is needed. No public exploit code has been identified and there is no evidence of active exploitation (not listed in CISA KEV), but a vendor patch is available and the issue should be treated as a genuine high-priority fix rather than a high-CVSS-but-low-risk artifact.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only low-level privileges to execute arbitrary operating-system commands on the affected deployment, giving full compromise of host confidentiality, integrity and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid account and network reachability to the DataStage service, plus the ability to reach a parameter or job-input path whose value is passed into a shell command without neutralization; no user interaction is needed and complexity is rated low. At time of analysis no public exploit code and no confirmed active exploitation were identified, and IBM has published a vendor patch via its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who holds a valid, low-privileged account to inject and execute arbitrary operating system commands through the product's command-handling logic, giving full compromise of confidentiality, integrity, and availability on the affected deployment. The flaw is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and requires no user interaction, but it is gated behind authentication - making stolen credentials or a malicious insider the realistic threat model rather than anonymous internet-wide exploitation. A vendor patch is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated, low-privilege remote attacker to execute arbitrary operating system commands on the affected host, with full loss of confidentiality, integrity, and availability. Exploitation requires only valid credentials on the Cloud Pak for Data instance and network reachability to the vulnerable component (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8); it is not exploitable by unauthenticated users. No public exploit code has been identified at time of analysis, but IBM has published a vendor patch, and the low complexity of the flaw combined with high impact makes prompt upgrading advisable.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-privileged Cloud Pak for Data account execute arbitrary operating system commands on the affected node, resulting in full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) with a CVSS 3.1 base score of 8.8. Exploitation is network-reachable and low-complexity with no user interaction (AV:N/AC:L/PR:L/UI:N), but it is gated behind a valid authenticated account that can reach the DataStage service, so exposure is limited to authenticated users of the 5.4.0.0 build. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; a vendor patch is available, so patched deployments are not exposed.
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid account plant special elements in a DataStage input path that are passed unsanitized into an operating-system command, resulting in arbitrary command execution with the privileges of the DataStage service. The prerequisite is a legitimate authenticated session (CVSS PR:L) on a network-reachable instance (AV:N/AC:L, UI:N), which limits realistic exposure to authorized users, compromised credentials, or malicious insiders on unpatched 5.4.0.0 deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the vendor rates impact at 9.9 and a vendor patch is already available, so urgency is driven mainly by patch adoption rather than observed exploitation.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated low-privilege user who can route a path-traversal payload into a file-handling operation. The flaw is network-reachable with low attack complexity and no user interaction required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), leaving possession of a valid session as the primary barrier. Publicly available exploit code exists in the form of a published gist, but the issue is not in CISA KEV and EPSS sits at only 0.42% (35th percentile), with CISA SSVC rating exploitation as none and automatable as no - a contained, targeted-abuse risk rather than a mass-exploitation one.
Arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote, authenticated attacker to write files to attacker-chosen locations on the underlying host because user-supplied file paths are not properly validated (CWE-73). Exploitation requires valid DataStage credentials (CVSS PR:L, unauthenticated access is not sufficient) but no user interaction and no special conditions, and a successful write has high confidentiality, integrity, and availability impact, giving a base score of 8.8. No public exploit code has been identified at time of analysis, EPSS is 0.61% (48th percentile), and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is a real-but-not-urgent priority rather than an emergency.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.
An authenticated user of IBM DataStage on Cloud Pak for Data 5.4.0.0 can abuse path traversal (CWE-22) in file path handling to write to or delete arbitrary files on the platform's shared storage, compromising data integrity and availability for other jobs and tenants using that storage. The flaw is remotely reachable with a valid low-privileged account (CVSS 8.1, AV:N/PR:L, C:N/I:H/A:H) and a vendor patch is available from IBM; there is no CISA KEV listing and no confirmed public exploit, and EPSS is a modest 0.50% (41st percentile), indicating opportunistic rather than widespread exploitation pressure.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible low-privileged user to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any authenticated DataStage account - including data engineers or analysts, not just administrators - can trigger full confidentiality, integrity, and availability compromise of the affected component. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. IBM has released a patch, but no public exploit has been identified and no EPSS or KEV signal is present in the provided data.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to users who are not authorized to see it, letting an attacker who already holds a valid low-privilege account read data outside their intended scope over the network with no user interaction and low attack complexity. The independent assessment rates the flaw as confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so integrity and availability are not affected and the practical limiting factor is the requirement for authenticated access plus network reachability of the Cloud Pak for Data instance - this is not an anonymous, pre-authentication attack. The one caveat worth flagging is that IBM's own vector (9.6, S:C/I:H/I:H) asserts scope change and integrity impact that our assessment does not corroborate from the advisory text; there is no public exploit code and no CISA KEV entry, so there is no public exploit identified at time of analysis, and IBM has published a vendor advisory with patch guidance.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user to read sensitive data, because namespace-wide secrets are exposed through file mounts that are reachable from the DataStage workload. The vulnerability is rated CVSS 8.8 by the vendor, but our independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a confidentiality-only issue with a scope change, reflecting that the exposed secrets belong to other tenants/services in the same Kubernetes/OpenShift namespace rather than to the vulnerable component itself; the source vector's claims of high integrity and availability impact are not supported by the CWE-200 description. Exploitation requires a valid authenticated account on the affected 5.4.0.0 build and no user interaction; there is no public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided. Organizations running this release should treat any credentials present in the affected namespace as potentially compromised.
XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit identified at time of analysis.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the user-defined function component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the job subroutine component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system. [CVSS 6.5 MEDIUM]
Datastage On Cloud Pak For Data is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used to impersonate other users in the system. [CVSS 8.1 HIGH]