This vulnerability allows a remote authenticated attacker to craft XML messages that trigger the external entity processing feature of the XML parser used by IBM DataStage on Cloud Pak for Data. The untrusted XML can include references to internal resources, permitting the attacker to read arbitrary files or obtain internal network information. The result is a disclosure of confidential data that an attacker can access from a remote location.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. The issue is resolved by applying the 5.4 patch 7 update or later.

The CVSS score of 7.7 indicates a high severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploitation risk is currently moderate but not known to be actively leveraged. The vulnerability requires authenticated access to the system, implying that the attack vector is remote but limited to users with valid credentials. Overall, the risk of exploitation is significant for environments with vulnerable or unpatched installations.