CVE-2025-36145
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
IBM watsonx.data versions 2.2 through 2.3.1 do not properly restrict inbound and outbound connections, which could allow an attacker to transfer or modify files without restrictions.
Risk Assessment
Lack of connection control can lead to unauthorized data transfer or file modification, compromising data confidentiality and integrity.
Recommendation
Update IBM watsonx.data to version 2.3.2 or later, and configure firewall rules to restrict connections.
Other vulnerabilities in IBM watsonx.data
See all- CVE-2025-36180Medium
IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.
- CVE-2025-36140Medium
IBM watsonx.data versions 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
Original NVD description (English source)
IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS