Home » Database

AVID-2026-R1219

Description

IBM Watson CP4D Data Stores file modificiation (CVE-2023-26282)

Details

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415.

Reason for inclusion in AVID: CVE-2023-26282 describes a software vulnerability in IBM Watson CP4D Data Stores (versions 4.6.0–4.6.3) that could allow a user with physical access to modify files or data on the system. This concerns a software component used within AI platforms to store data, thereby affecting AI systems and their data pipelines. It is a vulnerability in a software supply-chain-relevant component (data store/runtime used in AI deployments), not a hardware/firmware-only issue. The report includes affected versions, CVSS details, and a CWE mapping, providing sufficient evidence for classification.

References

Affected or Relevant Artifacts

  • Developer: IBM
  • Deployer: IBM
  • Artifact Details:
TypeName
SystemWatson CP4D Data Stores

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score4.2
Base Severity🟠 Medium
Attack VectorPHYSICAL
Attack Complexity🔴 High
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🔴 High
Availability ImpactNONE

CWE

IDDescription
CWE-73CWE-73 External Control of File Name or Path

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-03-05
  • Version: 0.3.3
  • AVID Entry