Home » Database

AVID-2026-R1236

Description

IBM Watson Machine Learning on Cloud Pak for Data server-side request forgery (CVE-2023-30444)

Details

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350.

Reason for inclusion in AVID: CVE-2023-30444 describes a server-side request forgery vulnerability in IBM Watson Machine Learning on Cloud Pak for Data, an AI platform component. It is a software vulnerability impacting AI tooling used to build/deploy/run ML systems, with potential for unauthorized requests and network-facing impact. This aligns with software supply-chain concerns in AI stacks. Sufficient evidence is provided in the CVE entry and IBM references.

References

Affected or Relevant Artifacts

  • Developer: IBM
  • Deployer: IBM
  • Artifact Details:
TypeName
SystemWatson Machine Learning on Cloud Pak for Data

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score7.1
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🟢 Low
Availability ImpactNONE

CWE

IDDescription
CWE-918CWE-918 Server-Side Request Forgery (SSRF)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-04-27
  • Version: 0.3.3
  • AVID Entry