Watsonx Orchestrate Cartridge For Cloud Pak For Data
Monthly
Broken server-side access control in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 lets an authenticated low-privileged user invoke administrative backend APIs directly, bypassing UI restrictions and performing administrative functions. The independent assessment rates integrity impact as high, with no confidentiality or availability impact. No CISA KEV listing or public exploit code is identified in the supplied intelligence, and IBM reports that a vendor patch is available.
Missing backend authorization checks in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data (4.8.4 through 4.8.5 and 5.0.0 through 5.4.2) let an authenticated low-privileged user invoke administrative API endpoints directly rather than through the UI, resulting in execution of privileged functions the account should not reach. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the attacker must already hold a valid account, and the assessed impact is integrity-only, with no confidentiality or availability effect stated. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is prioritized for remediation this month rather than as an emergency, with a vendor patch available.
An authorization weakness in the IBM watsonx Orchestrate Cartridge for Cloud Pak for Data (versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2) lets a user who already holds an account on the cartridge perform actions that should have been blocked by their assigned permissions, because the application improperly trusts server-side permission methods (CWE-650). Impact is bounded: scope is unchanged and only partial confidentiality and integrity effects are assessed (CVSS 5.4), with no availability impact. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV; IBM has published a fix advisory, and the vulnerability is best scheduled for patching this month rather than treated as an emergency. Note a data discrepancy worth resolving with the vendor: the supplied vector is PR:N (unauthenticated) while the description and independent assessment require a valid account (PR:L), and the vector also carries UI:R whereas the independent assessment uses UI:N.
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data can disclose sensitive source code to a network-reachable, high-privilege authenticated user. Versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 are affected; the CVSS 2.7 vector limits impact to low confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and a vendor patch is available.
Broken server-side access control in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 lets an authenticated low-privileged user invoke administrative backend APIs directly, bypassing UI restrictions and performing administrative functions. The independent assessment rates integrity impact as high, with no confidentiality or availability impact. No CISA KEV listing or public exploit code is identified in the supplied intelligence, and IBM reports that a vendor patch is available.
Missing backend authorization checks in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data (4.8.4 through 4.8.5 and 5.0.0 through 5.4.2) let an authenticated low-privileged user invoke administrative API endpoints directly rather than through the UI, resulting in execution of privileged functions the account should not reach. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the attacker must already hold a valid account, and the assessed impact is integrity-only, with no confidentiality or availability effect stated. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is prioritized for remediation this month rather than as an emergency, with a vendor patch available.
An authorization weakness in the IBM watsonx Orchestrate Cartridge for Cloud Pak for Data (versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2) lets a user who already holds an account on the cartridge perform actions that should have been blocked by their assigned permissions, because the application improperly trusts server-side permission methods (CWE-650). Impact is bounded: scope is unchanged and only partial confidentiality and integrity effects are assessed (CVSS 5.4), with no availability impact. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV; IBM has published a fix advisory, and the vulnerability is best scheduled for patching this month rather than treated as an emergency. Note a data discrepancy worth resolving with the vendor: the supplied vector is PR:N (unauthenticated) while the description and independent assessment require a valid account (PR:L), and the vector also carries UI:R whereas the independent assessment uses UI:N.
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data can disclose sensitive source code to a network-reachable, high-privilege authenticated user. Versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 are affected; the CVSS 2.7 vector limits impact to low confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and a vendor patch is available.