What’s Vulnerable › Vulnerabilities

CVE-2023-40683: IBM OpenPages with Watson privilege escalation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-19 · updated 2026-06-17
• Weakness: CWE-285

Description

IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application. IBM X-Force ID: 264005.

Affected products

• IBM OpenPages with Watson: from 8.3 before 8.3.0.2.7; 9.0 — fixed in 8.3.0.2.7

How to fix

Upgrade to a fixed version: IBM OpenPages with Watson 8.3.0.2.7. Check the vendor advisory for mitigations.

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/264005
• https://www.ibm.com/support/pages/node/7107774
• https://exchange.xforce.ibmcloud.com/vulnerabilities/264005
• https://www.ibm.com/support/pages/node/7107774

Get alerted when CVE-2023-40683 or the next vulnerability affects your stack