IBM disclosed a significant vulnerability in its watsonx.ai platform, potentially exposing users to cross-site scripting (XSS) attacks. The vulnerability, identified as CVE-2024-49785, affects both IBM watsonx.ai on Cloud Pak for Data and standalone IBM watsonx.ai installations.
The security flaw allows authenticated users to embed arbitrary JavaScript code in the Web UI when using unauthorized, third-party LLM prompts. This vulnerability could lead to altered functionality and, more critically, the potential disclosure of credentials within trusted sessions.
With a CVSS base score of 5.4, the vulnerability is classified as moderate in severity. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates that the attack can be launched remotely, requires low complexity, and necessitates user interaction.
The affected versions include IBM watsonx.ai on Cloud Pak for Data versions 4.8 to 5.0.3 and IBM watsonx.ai versions 1.1 to 2.0.3. This wide range of affected versions underscores the potential impact on many IBM customers using these AI solutions.
Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free
IBM has swiftly addressed the vulnerability and strongly recommends users upgrade to the latest versions of the affected products. For IBM watsonx.ai on IBM Software Hub, the fixed version is 5.1.0 and above, while for standalone IBM watsonx.ai, users should upgrade to version 2.1.0 or later.
The discovery of this vulnerability highlights the ongoing security challenges in AI and machine learning platforms. As these technologies become more integrated into business operations, ensuring their security becomes paramount.
The ability for authenticated users to inject malicious code into the Web UI raises concerns about the potential for data breaches and system compromises.
Security experts emphasize the importance of prompt patching and regular security audits for AI systems. The incident serves as a reminder that even advanced AI platforms can harbor vulnerabilities that malicious actors could exploit.
IBM’s quick response in addressing the issue and providing clear upgrade paths demonstrates the company’s commitment to security. However, the incident underscores the need for constant vigilance and robust security practices in the rapidly evolving field of AI and machine learning.
As organizations continue to adopt AI technologies like watsonx.ai, they must remain aware of the potential security risks and ensure they have processes in place for timely updates and vulnerability management. The incident serves as a wake-up call for the industry to prioritize security in AI development and deployment.
While IBM has not reported any known exploits of this vulnerability in the wild, users of affected versions are urged to upgrade immediately to mitigate any potential risks. As AI continues to play an increasingly critical role in business operations, maintaining the security and integrity of these systems will be crucial for organizations across all sectors.
Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!
NSA, CISA, and NIST have released joint security guidelines to help organizations detect, contain, and…
Hackers are exploiting a command injection flaw in SiteGuard Server Edition, a web application firewall…
A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a…
A 16-year-old flaw in Broadcom’s Wi-Fi software can let attackers within wireless range take control…
Google has announced a new set of Android security protections designed to stop mobile scams…
Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a…