CyberRota Analysis
AI-GeneratedIBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable due to improper handling of user-supplied strings, allowing an attacker to exploit IDOR and path traversal vulnerabilities on the shared /ds-storage PVC. This can lead to unauthorized access to sensitive job logs, which may contain connection strings and customer data. Organizations using this version of DataStage should prioritize remediation to prevent potential tenant-to-tenant data leakage.
Original NVD Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.