IBM watsonx.data versions 2.2 through 2.3.1 do not properly restrict inbound and outbound connections, allowing an attacker to freely transfer or modify files, potentially compromising data integrity and confidentiality.

The affected product is IBM watsonx.data, specifically versions 2.2.0 and 2.2.* as well as 2.3.1. Upgrading to watsonx.data 2.3.x or to CPD 5.3.x will resolve the issue.

The vulnerability has a CVSS score of 5.4, indicating a medium severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploits at this time. The likely attack vector involves unauthorized remote access over unrestricted inbound or outbound network connections, meaning an attacker on the same network or with network reach to the system could exploit the lack of connection restriction to transfer or alter files.