Skip to content
Submit incident
AII-1002-48367
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

IBM Watson Studio Local CSRF vulnerability in Jupyter notebooks

IBM disclosed a cross-site request forgery vulnerability in IBM Watson Studio Local version 1.2.3 affecting Jupyter notebooks. The vulnerability allows attackers to perform unauthorized actions through trusted users, with medium severity (CVSS 4.3).

8 December 2019 Β· IBM Β· Security and cyberattacks
8 December 2019

Drafted by Raidu Incident Detection, an automated system.

AII-1002-48367View source β†—
Quick facts
Organization
IBM (subject)
Category
Security and cyberattacks
Country
United States
Source
ibm.com
Date
8 December 2019
Drafted by
Raidu Incident Detection

What happened

IBM Watson Studio Local version 1.2.3 contains a cross-site request forgery (CSRF) vulnerability in Jupyter notebooks. The vulnerability allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Index analysis

The vulnerability has a CVSS base score of 4.3 (medium severity) with a vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating network-based access, low attack complexity, and low impact on integrity with no impact on confidentiality or availability.

Governance controls

IBM addressed the vulnerability and no workarounds or mitigations were documented in the security bulletin.

Classification

Organization
IBM (subject)
Category
Security and cyberattacks
Industry
IT infrastructure and hosting
Country
United States
Harm status
Potential harm
Intent
Unknown
Timing
Post-deployment
Consequences
None recorded
AI systems
IBM Watson Studio Local

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

ibm.com
https://www.ibm.com/support/pages/node/1144438