CVE-2024-22341 IBM Watson Query on Cloud Pak for Data information disclosure
Unauthorized users can access remote data source objects in IBM Watson Query due to improper privilege management, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22341?
CVE-2024-22341 is a medium-severity missing authorization vulnerability in IBM Watson Query on Cloud Pak for Data, published on 22 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.4, and 4.8.0 through 4.8.7 could allow unauthorized data access from a remote data source object due to improper privilege management.
Weakness: CWE-73
Which versions are affected by CVE-2024-22341?
It affects 1 product.
Products include Ibm Watson Query With Cloud Pak for Data.
How do I fix CVE-2024-22341?
No fix has been published for CVE-2024-22341 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-22341 being exploited?
There is no known exploitation of CVE-2024-22341 in the wild and no public exploit code.
Sources
Also known as GHSA-c9vm-r7mj-wm49.