IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF).
Date: 2023-04
Affected: ibm/watson_machine_learning_on_cloud_pak_for_data
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-30444
CWE: CWE-918
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350.


Mitigations:

Architectural layers (MAESTRO):