High · 7.0 CVE-2023-28958 EUVD-2023-32576GHSA-75qg-qmgw-fj6v

IBM Watson Knowledge Catalog CSV injection

Published Jul 10, 2023 · Updated Nov 12, 2024 · Assigned by ibm

Vendor: IBM Product: Watson Knowledge Catalog on Cloud Pak for Data

Description

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782.

Affected products

Vendor	Product	Affected	Fixed
IBM	Watson Knowledge Catalog on Cloud Pak for Data	4.0	—

References

https://www.ibm.com/support/pages/node/7009747 vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/251782 vdb-entry