CVE-2024-22341
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.4, and 4.8.0 through 4.8.7 could allow unauthorized data access from a remote data source object due to improper privilege management.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceIBM Watson Query on Cloud Pak for Data has improper privilege management that allows unauthorized data access from remote data source objects. This broken access control vulnerability enables attackers to bypass intended permission boundaries and retrieve data they should not have access to.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 4.0, <= 4.0.9>= 4.5, <= 4.5.3>= 4.6, <= 4.6.6>= 4.7, <= 4.7.4>= 4.8, <= 4.8.7CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check Watson Query versionLocate the installed Watson Query version in the Cloud Pak for Data admin console under 'Installed software' or run 'oc get wqr -n <namespace>' to get the Watson Query custom resource versionAffected if The installed version falls within any of these ranges: 4.0.0-4.0.9, 4.5.0-4.5.3, 4.6.0-4.6.6, 4.7.0-4.7.4, or 4.8.0-4.8.7
-
Identify user role assignmentsReview the IBM Cloud Pak for Data user management console to list all users and their assigned roles for Watson Query. Focus on users with Data Viewer, Data Engineer, or Administrator rolesAffected if Users exist who should not have access to certain remote data sources but are assigned roles that could grant broader data access than intended
-
Inspect data source object permissionsIn the Watson Query admin interface, examine the access control settings for each remote data source object. Check the 'Permissions' or 'Sharing' tab for each data source to see which roles or users can access itAffected if Data source objects show permission configurations that allow users to access data sources outside their intended scope, or if wildcard/broad access patterns exist
-
Test cross-boundary data accessUsing a test user account with limited permissions, attempt to query remote data source objects that should be outside that user's authorized scope. Verify if the system permits access that should be deniedAffected if Users can retrieve or query data from remote data sources they were not explicitly granted access to, demonstrating broken access control boundaries
If the installed Watson Query version is within any of the affected ranges listed and users can access remote data sources beyond their assigned permissions, the environment is vulnerable to CVE-2024-22341.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedApply the vendor-provided patches for all affected versions (4.0.10+, 4.5.4+, 4.6.7+, 4.7.5+, 4.8.8+) and verify that privilege configurations are correctly enforced post-update.
Upgrade to Watson Query with Cloud Pak for Data version 4.8.7 or later (the next release beyond all affected versions)
- 1. Identify the current installed version of Watson Query with Cloud Pak for Data by checking the Cloud Pak for Data administration console or using the 'cpd-cli manage' command
- 2. Plan an upgrade to a fixed version that is not listed as affected - IBM recommends upgrading to version 4.8.7 or later
- 3. Review IBM Cloud Pak for Data upgrade documentation and ensure prerequisites are met before initiating the upgrade
- 4. Perform a full backup of the current Watson Query configuration and data
- 5. Execute the upgrade following IBM's standard Cloud Pak for Data upgrade procedures
- 6. After upgrade, verify that Watson Query version is 4.8.7 or later and confirm unauthorized data access vulnerability is resolved
- 7. Test data source object access controls to ensure proper privilege management is enforced
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation3.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,040.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-22341 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-22341 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data