Vulnerabilites related to ibm - business_automation_workflow
cve-2022-42435
Vulnerability from cvelistv5
Published
2023-01-03 23:16
Modified
2024-08-03 13:10
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6852217 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/238054 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:10:41.010Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6852217"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/238054"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(204, 217, 226);\"\u003eIBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054.\u003c/span\u003e\n\n"
}
],
"value": "\nIBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-03T23:16:13.875Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6852217"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/238054"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow cross-site request forgery",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-42435",
"datePublished": "2023-01-03T23:16:13.875Z",
"dateReserved": "2022-10-06T15:51:26.497Z",
"dateUpdated": "2024-08-03T13:10:41.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29834
Vulnerability from cvelistv5
Published
2021-09-29 15:55
Modified
2024-09-17 01:56
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6493271 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/204832 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 Version: 19.0.0.2 Version: 19.0.0.3 Version: 20.0.0.1 Version: 20.0.0.2 Version: 21.0.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:03.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6493271"
},
{
"name": "ibm-baw-cve202129834-xss (204832)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204832"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.3"
},
{
"status": "affected",
"version": "20.0.0.1"
},
{
"status": "affected",
"version": "20.0.0.2"
},
{
"status": "affected",
"version": "21.0.2"
}
]
},
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
}
],
"datePublic": "2021-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 6.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:N/UI:N/I:L/AV:N/PR:L/S:C/C:L/AC:L/RC:C/E:H/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-29T15:55:11",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6493271"
},
{
"name": "ibm-baw-cve202129834-xss (204832)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204832"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-09-28T00:00:00",
"ID": "CVE-2021-29834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.2"
},
{
"version_value": "19.0.0.3"
},
{
"version_value": "20.0.0.1"
},
{
"version_value": "20.0.0.2"
},
{
"version_value": "21.0.2"
}
]
}
},
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "N"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6493271",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6493271 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6493271"
},
{
"name": "ibm-baw-cve202129834-xss (204832)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204832"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29834",
"datePublished": "2021-09-29T15:55:11.692123Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-17T01:56:18.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-43864
Vulnerability from cvelistv5
Published
2023-01-25 18:07
Modified
2024-08-03 13:40
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6857239 | vendor-advisory | |
| https://www.ibm.com/support/pages/node/6857223 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/239427 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Monitor |
Version: 8.5.5, 8.5.6, 8.5.7 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:40:06.714Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6857239"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6857223"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/239427"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Monitor",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5.5, 8.5.6, 8.5.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(204, 217, 226);\"\u003eIBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.\u003c/span\u003e\n\n"
}
],
"value": "\nIBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-25T18:07:21.454Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857239"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857223"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/239427"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow information disclosure",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-43864",
"datePublished": "2023-01-25T18:07:21.454Z",
"dateReserved": "2022-10-26T15:46:22.824Z",
"dateUpdated": "2024-08-03T13:40:06.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4557
Vulnerability from cvelistv5
Published
2020-06-29 14:00
Modified
2024-09-17 00:16
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6241338 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/183611 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:49.003Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6241338"
},
{
"name": "ibm-baw-cve20204557-xss (183611)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/183611"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
}
]
}
],
"datePublic": "2020-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/PR:L/AC:L/I:L/A:N/S:C/AV:N/C:L/UI:R/RL:O/E:H/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-29T14:00:16",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6241338"
},
{
"name": "ibm-baw-cve20204557-xss (183611)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/183611"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-28T00:00:00",
"ID": "CVE-2020-4557",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6241338",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6241338 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6241338"
},
{
"name": "ibm-baw-cve20204557-xss (183611)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/183611"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4557",
"datePublished": "2020-06-29T14:00:16.805405Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T00:16:08.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4204
Vulnerability from cvelistv5
Published
2019-05-10 14:40
Modified
2024-09-16 21:08
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10880499 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/159125 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/108328 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:33:36.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880499"
},
{
"name": "ibm-baw-cve20194204-xss (159125)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159125"
},
{
"name": "108328",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108328"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
}
]
}
],
"datePublic": "2019-05-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/I:L/AC:L/C:L/A:N/S:C/PR:L/UI:R/AV:N/RC:C/RL:O/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-15T11:06:04",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880499"
},
{
"name": "ibm-baw-cve20194204-xss (159125)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159125"
},
{
"name": "108328",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108328"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-09T00:00:00",
"ID": "CVE-2019-4204",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10880499",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 880499 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880499"
},
{
"name": "ibm-baw-cve20194204-xss (159125)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159125"
},
{
"name": "108328",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108328"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4204",
"datePublished": "2019-05-10T14:40:20.008444Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-16T21:08:22.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-38893
Vulnerability from cvelistv5
Published
2021-12-21 19:10
Modified
2024-09-17 00:26
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6527782 | x_refsource_CONFIRM | |
| https://www.ibm.com/support/pages/node/6526488 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/209512 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Cloud Pak for Automation |
Version: 21.0.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6527782"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6526488"
},
{
"name": "ibm-baw-cve202138893-xss (209512)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cloud Pak for Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "21.0.2"
}
]
},
{
"product": "Business Process Manager Standard",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5.5"
},
{
"status": "affected",
"version": "8.5.7.CF201706"
},
{
"status": "affected",
"version": "8.5.7.CF201703"
},
{
"status": "affected",
"version": "8.5.7.CF201612"
},
{
"status": "affected",
"version": "8.5.7.CF201609"
},
{
"status": "affected",
"version": "8.5.7.CF201606"
},
{
"status": "affected",
"version": "8.5.7"
},
{
"status": "affected",
"version": "8.5.6.2"
},
{
"status": "affected",
"version": "8.5.6.1"
},
{
"status": "affected",
"version": "8.5.6"
},
{
"status": "affected",
"version": "8.6"
},
{
"status": "affected",
"version": "8.5.0.2"
},
{
"status": "affected",
"version": "8.5.0.1"
},
{
"status": "affected",
"version": "8.5"
}
]
}
],
"datePublic": "2021-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 6.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:L/PR:L/C:L/S:C/UI:N/AC:L/AV:N/A:N/RC:C/RL:O/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-21T19:10:14",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6527782"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6526488"
},
{
"name": "ibm-baw-cve202138893-xss (209512)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-12-20T00:00:00",
"ID": "CVE-2021-38893",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cloud Pak for Automation",
"version": {
"version_data": [
{
"version_value": "21.0.2"
}
]
}
},
{
"product_name": "Business Process Manager Standard",
"version": {
"version_data": [
{
"version_value": "8.5.5"
},
{
"version_value": "8.5.7.CF201706"
},
{
"version_value": "8.5.7.CF201703"
},
{
"version_value": "8.5.7.CF201612"
},
{
"version_value": "8.5.7.CF201609"
},
{
"version_value": "8.5.7.CF201606"
},
{
"version_value": "8.5.7"
},
{
"version_value": "8.5.6.2"
},
{
"version_value": "8.5.6.1"
},
{
"version_value": "8.5.6"
},
{
"version_value": "8.6"
},
{
"version_value": "8.5.0.2"
},
{
"version_value": "8.5.0.1"
},
{
"version_value": "8.5"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "N"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6527782",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6527782 (Business Process Manager Standard)",
"url": "https://www.ibm.com/support/pages/node/6527782"
},
{
"name": "https://www.ibm.com/support/pages/node/6526488",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6526488 (Cloud Pak for Automation)",
"url": "https://www.ibm.com/support/pages/node/6526488"
},
{
"name": "ibm-baw-cve202138893-xss (209512)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38893",
"datePublished": "2021-12-21T19:10:14.320475Z",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-09-17T00:26:52.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4426
Vulnerability from cvelistv5
Published
2019-12-13 15:50
Modified
2024-09-16 16:43
Severity ?
EPSS score ?
Summary
The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/1116087 | x_refsource_CONFIRM | |
| https://www.ibm.com/support/pages/node/1135552 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/162772 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.1 Version: 19.0.0.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:33:37.981Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/1116087"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/1135552"
},
{
"name": "ibm-baw-cve20194426-xss (162772)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162772"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
}
]
},
{
"product": "Case Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.1.1"
},
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.0"
},
{
"status": "affected",
"version": "5.3CD"
}
]
}
],
"datePublic": "2019-12-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/PR:L/A:N/UI:R/S:C/C:L/I:L/AC:L/AV:N/RL:O/E:H/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-13T15:50:14",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/1116087"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/1135552"
},
{
"name": "ibm-baw-cve20194426-xss (162772)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162772"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-12-12T00:00:00",
"ID": "CVE-2019-4426",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.1"
},
{
"version_value": "19.0.0.2"
}
]
}
},
{
"product_name": "Case Manager",
"version": {
"version_data": [
{
"version_value": "5.1.1"
},
{
"version_value": "5.2.1"
},
{
"version_value": "5.2.0"
},
{
"version_value": "5.3CD"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/1116087",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 1116087 (Case Manager)",
"url": "https://www.ibm.com/support/pages/node/1116087"
},
{
"name": "https://www.ibm.com/support/pages/node/1135552",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 1135552 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/1135552"
},
{
"name": "ibm-baw-cve20194426-xss (162772)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162772"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4426",
"datePublished": "2019-12-13T15:50:14.191652Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-16T16:43:10.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4425
Vulnerability from cvelistv5
Published
2019-08-20 18:25
Modified
2024-09-16 22:21
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10959261 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/162771 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:33:37.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959261"
},
{
"name": "ibm-baw-cve20194425-info-disc (162771)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162771"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
}
]
}
],
"datePublic": "2019-08-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AC:L/A:N/C:H/PR:L/I:N/UI:R/AV:N/S:U/RL:O/RC:C/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-20T18:25:26",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959261"
},
{
"name": "ibm-baw-cve20194425-info-disc (162771)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162771"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-08-02T00:00:00",
"ID": "CVE-2019-4425",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "H",
"I": "N",
"PR": "L",
"S": "U",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10959261",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 959261 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959261"
},
{
"name": "ibm-baw-cve20194425-info-disc (162771)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162771"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4425",
"datePublished": "2019-08-20T18:25:26.812353Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-16T22:21:03.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-41735
Vulnerability from cvelistv5
Published
2022-12-07 16:40
Modified
2024-08-03 12:49
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 65687.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6845496 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/237809 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 21.0.1 ≤ Version: 20.0.0.1 ≤ Version: 19.0.0.1 ≤ |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:49:44.044Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6845496"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/237809"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"lessThan": "21.0.3.1",
"status": "affected",
"version": "21.0.1",
"versionType": "semver"
},
{
"lessThan": "20.0.0.2",
"status": "affected",
"version": "20.0.0.1",
"versionType": "semver"
},
{
"lessThan": "19.0.0.3",
"status": "affected",
"version": "19.0.0.1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 65687."
}
],
"value": "IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 65687."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-07T16:40:29.374Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6845496"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/237809"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Process Manager cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-41735",
"datePublished": "2022-12-07T16:40:29.374Z",
"dateReserved": "2022-09-28T17:18:53.376Z",
"dateUpdated": "2024-08-03T12:49:44.044Z",
"requesterUserId": "69938c14-a5a2-41ac-a450-71ed41911136",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4532
Vulnerability from cvelistv5
Published
2020-06-17 17:40
Modified
2024-09-16 21:07
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6233276 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/182716 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Process Manager Express |
Version: 8.6 Version: 8.5.7.CF201706 Version: 8.5.7.CF201703 Version: 8.5.7.CF201612 Version: 8.5.7.CF201609 Version: 8.5.7.CF201606 Version: 8.5.7 Version: 8.5.6.2 Version: 8.5.6.1 Version: 8.5.6 Version: 8.5.5 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.930Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6233276"
},
{
"name": "ibm-baw-cve20204532-info-disc (182716)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182716"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager Express",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.6"
},
{
"status": "affected",
"version": "8.5.7.CF201706"
},
{
"status": "affected",
"version": "8.5.7.CF201703"
},
{
"status": "affected",
"version": "8.5.7.CF201612"
},
{
"status": "affected",
"version": "8.5.7.CF201609"
},
{
"status": "affected",
"version": "8.5.7.CF201606"
},
{
"status": "affected",
"version": "8.5.7"
},
{
"status": "affected",
"version": "8.5.6.2"
},
{
"status": "affected",
"version": "8.5.6.1"
},
{
"status": "affected",
"version": "8.5.6"
},
{
"status": "affected",
"version": "8.5.5"
}
]
}
],
"datePublic": "2020-06-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:N/UI:N/PR:N/AC:L/C:L/A:N/S:U/AV:N/E:U/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-17T17:40:12",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6233276"
},
{
"name": "ibm-baw-cve20204532-info-disc (182716)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182716"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-16T00:00:00",
"ID": "CVE-2020-4532",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager Express",
"version": {
"version_data": [
{
"version_value": "8.6"
},
{
"version_value": "8.5.7.CF201706"
},
{
"version_value": "8.5.7.CF201703"
},
{
"version_value": "8.5.7.CF201612"
},
{
"version_value": "8.5.7.CF201609"
},
{
"version_value": "8.5.7.CF201606"
},
{
"version_value": "8.5.7"
},
{
"version_value": "8.5.6.2"
},
{
"version_value": "8.5.6.1"
},
{
"version_value": "8.5.6"
},
{
"version_value": "8.5.5"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6233276",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6233276 (Business Process Manager Express)",
"url": "https://www.ibm.com/support/pages/node/6233276"
},
{
"name": "ibm-baw-cve20204532-info-disc (182716)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182716"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4532",
"datePublished": "2020-06-17T17:40:12.479710Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-16T21:07:34.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29835
Vulnerability from cvelistv5
Published
2021-10-22 19:00
Modified
2024-09-16 16:28
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6507319 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/204833 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0 Version: 19.0 Version: 20.0 Version: 21.0 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:03.150Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6507319"
},
{
"name": "ibm-baw-cve202129835-xss (204833)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204833"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
},
{
"status": "affected",
"version": "21.0"
}
]
}
],
"datePublic": "2021-10-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 4.7,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/C:L/PR:L/UI:R/S:C/A:N/AV:N/I:L/AC:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-22T19:00:12",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6507319"
},
{
"name": "ibm-baw-cve202129835-xss (204833)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204833"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-10-21T00:00:00",
"ID": "CVE-2021-29835",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
},
{
"version_value": "21.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6507319",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6507319 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6507319"
},
{
"name": "ibm-baw-cve202129835-xss (204833)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204833"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29835",
"datePublished": "2021-10-22T19:00:12.252354Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-16T16:28:45.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-2000
Vulnerability from cvelistv5
Published
2019-04-08 14:50
Modified
2024-09-16 19:35
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10870496 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/154890 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/107851 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:39.558Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870496"
},
{
"name": "ibm-bpm-cve20182000-csrf (154890)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154890"
},
{
"name": "107851",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/107851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
}
]
}
],
"datePublic": "2019-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.8,
"temporalSeverity": "LOW",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/C:N/AC:L/I:L/A:N/PR:N/AV:N/UI:R/S:U/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-11T05:06:06",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870496"
},
{
"name": "ibm-bpm-cve20182000-csrf (154890)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154890"
},
{
"name": "107851",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/107851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-04-04T00:00:00",
"ID": "CVE-2018-2000",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "N",
"I": "L",
"PR": "N",
"S": "U",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10870496",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 870496 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870496"
},
{
"name": "ibm-bpm-cve20182000-csrf (154890)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154890"
},
{
"name": "107851",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/107851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-2000",
"datePublished": "2019-04-08T14:50:38.043143Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T19:35:45.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-35279
Vulnerability from cvelistv5
Published
2022-11-03 00:00
Modified
2024-08-03 09:36
Severity ?
EPSS score ?
Summary
"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | n/a | IBM Business Automation Workflow |
Version: "18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1" |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:36:44.258Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6829847"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "IBM Business Automation Workflow",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "\"18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1\""
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "\"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-03T00:00:00",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"url": "https://www.ibm.com/support/pages/node/6829847"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-35279",
"datePublished": "2022-11-03T00:00:00",
"dateReserved": "2022-07-06T00:00:00",
"dateUpdated": "2024-08-03T09:36:44.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1885
Vulnerability from cvelistv5
Published
2019-04-08 14:50
Modified
2024-09-17 00:25
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10878106 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/107863 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:38.618Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"
},
{
"name": "ibm-business-cve20181885-info-disc (152020)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"
},
{
"name": "107863",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/107863"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
}
]
}
],
"datePublic": "2019-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:L/C:L/PR:N/A:N/I:N/AV:N/S:U/UI:N/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-11T11:06:03",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"
},
{
"name": "ibm-business-cve20181885-info-disc (152020)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"
},
{
"name": "107863",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/107863"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-04-04T00:00:00",
"ID": "CVE-2018-1885",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10878106",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 878106 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"
},
{
"name": "ibm-business-cve20181885-info-disc (152020)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"
},
{
"name": "107863",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/107863"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1885",
"datePublished": "2019-04-08T14:50:37.845952Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-17T00:25:32.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4149
Vulnerability from cvelistv5
Published
2019-09-05 14:50
Modified
2024-09-16 22:25
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10885104 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/158415 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:28.032Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10885104"
},
{
"name": "ibm-baw-cve20194149-xss (158415)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158415"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.2"
}
]
},
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.6.0.0"
},
{
"status": "affected",
"version": "8.5.6.0"
},
{
"status": "affected",
"version": "8.5.6.0CF2"
},
{
"status": "affected",
"version": "8.5.7.0"
},
{
"status": "affected",
"version": "8.5.7.0CF2017.06"
},
{
"status": "affected",
"version": "8.6.0.0CF2018.03"
}
]
}
],
"datePublic": "2019-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AC:L/UI:R/AV:N/I:L/PR:L/A:N/S:C/C:L/RL:O/E:H/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-05T14:50:15",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10885104"
},
{
"name": "ibm-baw-cve20194149-xss (158415)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158415"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-08-30T00:00:00",
"ID": "CVE-2019-4149",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.2"
}
]
}
},
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.6.0.0"
},
{
"version_value": "8.5.6.0"
},
{
"version_value": "8.5.6.0CF2"
},
{
"version_value": "8.5.7.0"
},
{
"version_value": "8.5.7.0CF2017.06"
},
{
"version_value": "8.6.0.0CF2018.03"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10885104",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 885104 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10885104"
},
{
"name": "ibm-baw-cve20194149-xss (158415)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158415"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4149",
"datePublished": "2019-09-05T14:50:15.508801Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-16T22:25:21.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29775
Vulnerability from cvelistv5
Published
2021-06-28 15:55
Modified
2024-09-16 16:52
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6465127 | x_refsource_CONFIRM | |
| https://www.ibm.com/support/pages/node/6467057 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/203029 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 Version: 19.0.0.2 Version: 19.0.0.3 Version: 20.0.0.1 Version: 20.0.0.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:02.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6467057"
},
{
"name": "ibm-bpm-cve202129775-xss (203029)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/203029"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.3"
},
{
"status": "affected",
"version": "20.0.0.1"
},
{
"status": "affected",
"version": "20.0.0.2"
}
]
},
{
"product": "Cloud Pak for Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "20.0.3.IF002"
},
{
"status": "affected",
"version": "21.0.1"
}
]
}
],
"datePublic": "2021-06-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 6.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/C:L/UI:N/S:C/AC:L/A:N/PR:L/I:L/E:H/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-28T15:55:26",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6467057"
},
{
"name": "ibm-bpm-cve202129775-xss (203029)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/203029"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-06-25T00:00:00",
"ID": "CVE-2021-29775",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.2"
},
{
"version_value": "19.0.0.3"
},
{
"version_value": "20.0.0.1"
},
{
"version_value": "20.0.0.2"
}
]
}
},
{
"product_name": "Cloud Pak for Automation",
"version": {
"version_data": [
{
"version_value": "20.0.3.IF002"
},
{
"version_value": "21.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "N"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6465127",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6465127 (Cloud Pak for Automation)",
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"name": "https://www.ibm.com/support/pages/node/6467057",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6467057 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6467057"
},
{
"name": "ibm-bpm-cve202129775-xss (203029)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/203029"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29775",
"datePublished": "2021-06-28T15:55:26.875537Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-16T16:52:52.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4045
Vulnerability from cvelistv5
Published
2019-04-08 14:50
Modified
2024-09-17 01:56
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10870494 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/156241 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870494"
},
{
"name": "ibm-bpm-cve20194045-gain-access (156241)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/156241"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
}
]
}
],
"datePublic": "2019-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.8,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/S:U/UI:N/AC:L/C:N/A:N/PR:L/I:L/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-08T14:50:38",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870494"
},
{
"name": "ibm-bpm-cve20194045-gain-access (156241)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/156241"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-04-04T00:00:00",
"ID": "CVE-2019-4045",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "N",
"I": "L",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10870494",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 870494 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870494"
},
{
"name": "ibm-bpm-cve20194045-gain-access (156241)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/156241"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4045",
"datePublished": "2019-04-08T14:50:38.084656Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-17T01:56:35.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1674
Vulnerability from cvelistv5
Published
2018-09-20 15:00
Modified
2024-09-16 16:13
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1041717 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/145109 | vdb-entry, x_refsource_XF | |
| https://www.ibm.com/support/docview.wss?uid=ibm10720035 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.5.0.1 Version: 8.5.5 Version: 8.5.6 Version: 8.5.7 Version: 8.6 Version: 8.6.0.CF201712 Version: 8.5.0.2 Version: 8.5.6.1 Version: 8.5.6.2 Version: 8.5.7.CF201606 Version: 8.5.7.CF201609 Version: 8.5.7.CF201612 Version: 8.5.7.CF201703 Version: 8.5.7.CF201706 Version: 8.6.0.CF201803 Version: 18.0.0.0 Version: 18.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:07:44.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1041717",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041717"
},
{
"name": "ibm-bpm-cve20181674-sql-injection(145109)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/145109"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10720035"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.5.0.1"
},
{
"status": "affected",
"version": "8.5.5"
},
{
"status": "affected",
"version": "8.5.6"
},
{
"status": "affected",
"version": "8.5.7"
},
{
"status": "affected",
"version": "8.6"
},
{
"status": "affected",
"version": "8.6.0.CF201712"
},
{
"status": "affected",
"version": "8.5.0.2"
},
{
"status": "affected",
"version": "8.5.6.1"
},
{
"status": "affected",
"version": "8.5.6.2"
},
{
"status": "affected",
"version": "8.5.7.CF201606"
},
{
"status": "affected",
"version": "8.5.7.CF201609"
},
{
"status": "affected",
"version": "8.5.7.CF201612"
},
{
"status": "affected",
"version": "8.5.7.CF201703"
},
{
"status": "affected",
"version": "8.5.7.CF201706"
},
{
"status": "affected",
"version": "8.6.0.CF201803"
},
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
}
]
}
],
"datePublic": "2018-09-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:L/AC:L/AV:N/C:L/I:L/PR:L/S:U/UI:N/E:U/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Data Manipulation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-27T09:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "1041717",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041717"
},
{
"name": "ibm-bpm-cve20181674-sql-injection(145109)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/145109"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10720035"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2018-09-19T00:00:00",
"ID": "CVE-2018-1674",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.5.0.1"
},
{
"version_value": "8.5.5"
},
{
"version_value": "8.5.6"
},
{
"version_value": "8.5.7"
},
{
"version_value": "8.6"
},
{
"version_value": "8.6.0.CF201712"
},
{
"version_value": "8.5.0.2"
},
{
"version_value": "8.5.6.1"
},
{
"version_value": "8.5.6.2"
},
{
"version_value": "8.5.7.CF201606"
},
{
"version_value": "8.5.7.CF201609"
},
{
"version_value": "8.5.7.CF201612"
},
{
"version_value": "8.5.7.CF201703"
},
{
"version_value": "8.5.7.CF201706"
},
{
"version_value": "8.6.0.CF201803"
},
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Data Manipulation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1041717",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041717"
},
{
"name": "ibm-bpm-cve20181674-sql-injection(145109)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/145109"
},
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10720035",
"refsource": "CONFIRM",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10720035"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1674",
"datePublished": "2018-09-20T15:00:00Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T16:13:57.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-22361
Vulnerability from cvelistv5
Published
2022-05-31 15:45
Modified
2024-09-16 19:30
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6590411 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/220784 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.6.0.0 Version: 8.5.0.0 Version: 8.5.0.201706 Version: 8.6.0.201803 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:14:54.839Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6590411"
},
{
"name": "ibm-baw-cve202222361-csrf (220784)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.6.0.0"
},
{
"status": "affected",
"version": "8.5.0.0"
},
{
"status": "affected",
"version": "8.5.0.201706"
},
{
"status": "affected",
"version": "8.6.0.201803"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.3"
},
{
"status": "affected",
"version": "20.0.0.1"
},
{
"status": "affected",
"version": "20.0.0.2"
},
{
"status": "affected",
"version": "21.0.3"
},
{
"status": "affected",
"version": "21.0.1"
}
]
}
],
"datePublic": "2022-05-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.8,
"temporalSeverity": "LOW",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/PR:N/S:U/C:N/A:N/AC:L/AV:N/UI:R/I:L/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-31T15:45:13",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6590411"
},
{
"name": "ibm-baw-cve202222361-csrf (220784)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2022-05-27T00:00:00",
"ID": "CVE-2022-22361",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.6.0.0"
},
{
"version_value": "8.5.0.0"
},
{
"version_value": "8.5.0.201706"
},
{
"version_value": "8.6.0.201803"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.3"
},
{
"version_value": "20.0.0.1"
},
{
"version_value": "20.0.0.2"
},
{
"version_value": "21.0.3"
},
{
"version_value": "21.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "N",
"I": "L",
"PR": "N",
"S": "U",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6590411",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6590411 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6590411"
},
{
"name": "ibm-baw-cve202222361-csrf (220784)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-22361",
"datePublished": "2022-05-31T15:45:13.828869Z",
"dateReserved": "2022-01-03T00:00:00",
"dateUpdated": "2024-09-16T19:30:44.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4794
Vulnerability from cvelistv5
Published
2020-12-21 17:50
Modified
2024-09-16 18:43
Severity ?
EPSS score ?
Summary
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6359463 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/189445 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | IBM | Automation Workstream Services |
Version: 19.0.3 Version: 20.0.1 Version: 20.0.2 |
||||||||
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:14:58.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6359463"
},
{
"name": "ibm-icp4a-cve20204794-input-validation (189445)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/189445"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Workstream Services",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "19.0.3"
},
{
"status": "affected",
"version": "20.0.1"
},
{
"status": "affected",
"version": "20.0.2"
}
]
},
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
},
{
"status": "affected",
"version": "18.0"
}
]
}
],
"datePublic": "2020-12-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.7,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:L/I:N/C:L/AC:L/PR:L/S:U/AV:N/UI:N/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of Service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-21T17:50:30",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6359463"
},
{
"name": "ibm-icp4a-cve20204794-input-validation (189445)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/189445"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-12-18T00:00:00",
"ID": "CVE-2020-4794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Workstream Services",
"version": {
"version_data": [
{
"version_value": "19.0.3"
},
{
"version_value": "20.0.1"
},
{
"version_value": "20.0.2"
}
]
}
},
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "19.0"
},
{
"version_value": "20.0"
},
{
"version_value": "18.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6359463",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6359463 (Automation Workstream Services)",
"url": "https://www.ibm.com/support/pages/node/6359463"
},
{
"name": "ibm-icp4a-cve20204794-input-validation (189445)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/189445"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4794",
"datePublished": "2020-12-21T17:50:30.680303Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-16T18:43:25.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-38390
Vulnerability from cvelistv5
Published
2022-11-17 16:48
Modified
2024-08-03 10:54
Severity ?
EPSS score ?
Summary
Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6839847 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/233978 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 22.0.1 Version: 21.0.1 < 21.0.3.1 Version: 20.0.0.1 < 20.0.0.2 Version: 19.0.0.1 < 19.0.0.3 Version: 18.0.0.0 < 18.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:54:03.745Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6839847"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233978"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "22.0.1"
},
{
"lessThan": "21.0.3.1",
"status": "affected",
"version": "21.0.1",
"versionType": "custom"
},
{
"lessThan": "20.0.0.2",
"status": "affected",
"version": "20.0.0.1",
"versionType": "custom"
},
{
"lessThan": "19.0.0.3",
"status": "affected",
"version": "19.0.0.1",
"versionType": "custom"
},
{
"lessThan": "18.0.0.2",
"status": "affected",
"version": "18.0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978."
}
],
"value": "Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-17T16:48:11.088Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6839847"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233978"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-38390",
"datePublished": "2022-11-17T16:48:11.088Z",
"dateReserved": "2022-08-16T18:42:49.433Z",
"dateUpdated": "2024-08-03T10:54:03.745Z",
"requesterUserId": "69938c14-a5a2-41ac-a450-71ed41911136",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4531
Vulnerability from cvelistv5
Published
2020-09-25 17:00
Modified
2024-09-16 18:03
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6336935 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/182715 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0 Version: 19.0 Version: 20.0 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.922Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6336935"
},
{
"name": "ibm-baw-cve20204531-info-disc (182715)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182715"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
}
]
},
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.0"
},
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
}
],
"datePublic": "2020-09-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/S:U/AV:N/AC:L/UI:N/C:L/I:N/PR:N/A:N/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-25T17:00:18",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6336935"
},
{
"name": "ibm-baw-cve20204531-info-disc (182715)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182715"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-09-24T00:00:00",
"ID": "CVE-2020-4531",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
}
]
}
},
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.0"
},
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6336935",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6336935 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6336935"
},
{
"name": "ibm-baw-cve20204531-info-disc (182715)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182715"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4531",
"datePublished": "2020-09-25T17:00:18.465970Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-16T18:03:32.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4530
Vulnerability from cvelistv5
Published
2020-09-15 13:50
Modified
2024-09-17 01:01
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6332417 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/182714 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.0 Version: 8.5 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.916Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6332417"
},
{
"name": "ibm-baw-cve20204530-xss (182714)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182714"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.0"
},
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "C.D.0"
}
]
}
],
"datePublic": "2020-09-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/A:N/AC:L/S:C/AV:N/I:L/C:L/UI:R/PR:L/RC:C/RL:O/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-15T13:50:24",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6332417"
},
{
"name": "ibm-baw-cve20204530-xss (182714)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182714"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-09-14T00:00:00",
"ID": "CVE-2020-4530",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.0"
},
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "C.D.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6332417",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6332417 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6332417"
},
{
"name": "ibm-baw-cve20204530-xss (182714)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182714"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4530",
"datePublished": "2020-09-15T13:50:25.023912Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T01:01:53.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-38883
Vulnerability from cvelistv5
Published
2021-12-17 17:05
Modified
2024-09-16 19:25
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6527270 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/209165 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.883Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6527270"
},
{
"name": "ibm-baw-cve202138883-xss (209165)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209165"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "19.0.0"
},
{
"status": "affected",
"version": "20.0.0"
},
{
"status": "affected",
"version": "21.0"
},
{
"status": "affected",
"version": "18.0.0"
}
]
}
],
"datePublic": "2021-12-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/UI:R/S:C/AC:L/I:L/PR:L/A:N/AV:N/C:L/RL:O/RC:C/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-17T17:05:11",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6527270"
},
{
"name": "ibm-baw-cve202138883-xss (209165)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209165"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-12-16T00:00:00",
"ID": "CVE-2021-38883",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "19.0.0"
},
{
"version_value": "20.0.0"
},
{
"version_value": "21.0"
},
{
"version_value": "18.0.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6527270",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6527270 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6527270"
},
{
"name": "ibm-baw-cve202138883-xss (209165)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209165"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38883",
"datePublished": "2021-12-17T17:05:11.690686Z",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-09-16T19:25:14.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29753
Vulnerability from cvelistv5
Published
2021-11-05 17:15
Modified
2024-09-17 02:42
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6513703 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/201919 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:02.454Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6513703"
},
{
"name": "ibm-baw-cve202129753-info-disc (201919)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201919"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
},
{
"status": "affected",
"version": "21.0"
}
]
}
],
"datePublic": "2021-11-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/PR:N/C:H/S:U/AV:N/UI:N/A:N/AC:H/I:N/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-05T17:15:11",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6513703"
},
{
"name": "ibm-baw-cve202129753-info-disc (201919)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201919"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-11-04T00:00:00",
"ID": "CVE-2021-29753",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
},
{
"version_value": "21.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "N",
"C": "H",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6513703",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6513703 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6513703"
},
{
"name": "ibm-baw-cve202129753-info-disc (201919)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201919"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29753",
"datePublished": "2021-11-05T17:15:11.376879Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-17T02:42:34.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4516
Vulnerability from cvelistv5
Published
2020-09-08 14:30
Modified
2024-09-17 04:29
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6326901 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/182371 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.968Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6326901"
},
{
"name": "ibm-bpm-cve20204516-xss (182371)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182371"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
}
]
}
],
"datePublic": "2020-09-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/I:L/PR:L/A:N/UI:R/AC:L/S:C/C:L/AV:N/RC:C/RL:O/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-08T14:30:24",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6326901"
},
{
"name": "ibm-bpm-cve20204516-xss (182371)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182371"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-09-04T00:00:00",
"ID": "CVE-2020-4516",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6326901",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6326901 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6326901"
},
{
"name": "ibm-bpm-cve20204516-xss (182371)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182371"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4516",
"datePublished": "2020-09-08T14:30:24.140917Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T04:29:20.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4669
Vulnerability from cvelistv5
Published
2020-02-27 16:10
Modified
2024-09-17 02:16
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/3552261 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/171254 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.1 Version: 19.0.0.3 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:40:49.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/3552261"
},
{
"name": "ibm-bpm-cve20194669-sql-injection (171254)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/171254"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.3"
}
]
},
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.6.0.0"
},
{
"status": "affected",
"version": "8.5.7.0"
},
{
"status": "affected",
"version": "8.6.0.0.CF2018.03"
},
{
"status": "affected",
"version": "8.5.7.0.2017.06"
}
]
}
],
"datePublic": "2020-02-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:L/A:L/AC:L/UI:N/AV:N/PR:L/C:L/S:U/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Data Manipulation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T16:10:16",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/3552261"
},
{
"name": "ibm-bpm-cve20194669-sql-injection (171254)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/171254"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-02-26T00:00:00",
"ID": "CVE-2019-4669",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.1"
},
{
"version_value": "19.0.0.3"
}
]
}
},
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.6.0.0"
},
{
"version_value": "8.5.7.0"
},
{
"version_value": "8.6.0.0.CF2018.03"
},
{
"version_value": "8.5.7.0.2017.06"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Data Manipulation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/3552261",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 3552261 (Business Process Manager)",
"url": "https://www.ibm.com/support/pages/node/3552261"
},
{
"name": "ibm-bpm-cve20194669-sql-injection (171254)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/171254"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4669",
"datePublished": "2020-02-27T16:10:16.660427Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-17T02:16:45.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4410
Vulnerability from cvelistv5
Published
2019-07-01 15:05
Modified
2024-09-16 20:36
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10888037 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/162657 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/108993 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:33:38.050Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10888037"
},
{
"name": "ibm-baw-cve20194410-xss (162657)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162657"
},
{
"name": "108993",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108993"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
}
]
}
],
"datePublic": "2019-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/A:N/S:C/C:L/PR:L/AV:N/AC:L/I:L/UI:R/RL:O/E:H/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-03T11:06:06",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10888037"
},
{
"name": "ibm-baw-cve20194410-xss (162657)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162657"
},
{
"name": "108993",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108993"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-06-28T00:00:00",
"ID": "CVE-2019-4410",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10888037",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 888037 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10888037"
},
{
"name": "ibm-baw-cve20194410-xss (162657)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162657"
},
{
"name": "108993",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108993"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4410",
"datePublished": "2019-07-01T15:05:38.491762Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-16T20:36:39.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1848
Vulnerability from cvelistv5
Published
2018-12-14 15:30
Modified
2024-09-16 23:41
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/150947 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/106217 | vdb-entry, x_refsource_BID | |
| https://www.ibm.com/support/docview.wss?uid=ibm10743005 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:38.561Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ibm-baw-cve20181848-xss(150947)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"name": "106217",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
}
]
}
],
"datePublic": "2018-12-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/A:N/AC:L/AV:N/C:L/I:L/PR:N/S:C/UI:R/E:H/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-12-18T10:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "ibm-baw-cve20181848-xss(150947)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"name": "106217",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2018-12-13T00:00:00",
"ID": "CVE-2018-1848",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "N",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ibm-baw-cve20181848-xss(150947)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"name": "106217",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106217"
},
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10743005",
"refsource": "CONFIRM",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1848",
"datePublished": "2018-12-14T15:30:00Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T23:41:48.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4900
Vulnerability from cvelistv5
Published
2020-11-30 15:30
Modified
2024-09-16 19:40
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6373004 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/190991 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 19.0.0.3 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:14:59.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6373004"
},
{
"name": "ibm-baw-cve20204900-info-disc (190991)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190991"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "19.0.0.3"
}
]
}
],
"datePublic": "2020-11-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:N/AC:H/PR:N/AV:L/C:H/S:U/UI:N/A:N/RL:O/RC:C/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-30T15:30:31",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6373004"
},
{
"name": "ibm-baw-cve20204900-info-disc (190991)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190991"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-11-26T00:00:00",
"ID": "CVE-2020-4900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "19.0.0.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "L",
"C": "H",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6373004",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6373004 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6373004"
},
{
"name": "ibm-baw-cve20204900-info-disc (190991)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190991"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4900",
"datePublished": "2020-11-30T15:30:31.161359Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-16T19:40:34.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-38900
Vulnerability from cvelistv5
Published
2021-12-21 19:10
Modified
2024-09-17 01:40
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6527776 | x_refsource_CONFIRM | |
| https://www.ibm.com/support/pages/node/6528296 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/209607 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 Version: 19.0.0.2 Version: 19.0.0.3 Version: 20.0.0.1 Version: 20.0.0.2 Version: 21.0.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.879Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6527776"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6528296"
},
{
"name": "ibm-baw-cve202138900-info-disc (209607)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209607"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.3"
},
{
"status": "affected",
"version": "20.0.0.1"
},
{
"status": "affected",
"version": "20.0.0.2"
},
{
"status": "affected",
"version": "21.0.2"
}
]
},
{
"product": "Cloud Pak for Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "21.0.2"
}
]
}
],
"datePublic": "2021-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:N/AV:N/AC:L/UI:N/S:U/C:H/PR:H/I:N/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-21T19:10:15",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6527776"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6528296"
},
{
"name": "ibm-baw-cve202138900-info-disc (209607)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209607"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-12-20T00:00:00",
"ID": "CVE-2021-38900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.2"
},
{
"version_value": "19.0.0.3"
},
{
"version_value": "20.0.0.1"
},
{
"version_value": "20.0.0.2"
},
{
"version_value": "21.0.2"
}
]
}
},
{
"product_name": "Cloud Pak for Automation",
"version": {
"version_data": [
{
"version_value": "21.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "H",
"I": "N",
"PR": "H",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6527776",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6527776 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6527776"
},
{
"name": "https://www.ibm.com/support/pages/node/6528296",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6528296 (Cloud Pak for Automation)",
"url": "https://www.ibm.com/support/pages/node/6528296"
},
{
"name": "ibm-baw-cve202138900-info-disc (209607)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209607"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38900",
"datePublished": "2021-12-21T19:10:16.020969Z",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-09-17T01:40:57.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4446
Vulnerability from cvelistv5
Published
2020-05-06 13:45
Modified
2024-09-16 20:06
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6205805 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/181126 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager Standard |
Version: 8.5.5 Version: 8.5.7.CF201706 Version: 8.5.7.CF201703 Version: 8.5.7.CF201612 Version: 8.5.7.CF201609 Version: 8.5.7.CF201606 Version: 8.5.7 Version: 8.5.6.2 Version: 8.5.6.1 Version: 8.5.6 Version: 8.6 Version: 8.5.0.2 Version: 8.5.0.1 Version: 8.5 Version: 8.0.1.3 Version: 8.0.1.2 Version: 8.0.1.1 Version: 8.0.1 Version: 8.0 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.740Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6205805"
},
{
"name": "ibm-bpm-cve20204446-weak-security (181126)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181126"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager Standard",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5.5"
},
{
"status": "affected",
"version": "8.5.7.CF201706"
},
{
"status": "affected",
"version": "8.5.7.CF201703"
},
{
"status": "affected",
"version": "8.5.7.CF201612"
},
{
"status": "affected",
"version": "8.5.7.CF201609"
},
{
"status": "affected",
"version": "8.5.7.CF201606"
},
{
"status": "affected",
"version": "8.5.7"
},
{
"status": "affected",
"version": "8.5.6.2"
},
{
"status": "affected",
"version": "8.5.6.1"
},
{
"status": "affected",
"version": "8.5.6"
},
{
"status": "affected",
"version": "8.6"
},
{
"status": "affected",
"version": "8.5.0.2"
},
{
"status": "affected",
"version": "8.5.0.1"
},
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.0.1.3"
},
{
"status": "affected",
"version": "8.0.1.2"
},
{
"status": "affected",
"version": "8.0.1.1"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "19.0.0.1"
}
]
}
],
"datePublic": "2020-05-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.8,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:N/AV:N/A:N/UI:N/PR:L/S:U/C:L/AC:L/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Bypass Security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-05-06T13:45:19",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6205805"
},
{
"name": "ibm-bpm-cve20204446-weak-security (181126)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181126"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-05-05T00:00:00",
"ID": "CVE-2020-4446",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager Standard",
"version": {
"version_data": [
{
"version_value": "8.5.5"
},
{
"version_value": "8.5.7.CF201706"
},
{
"version_value": "8.5.7.CF201703"
},
{
"version_value": "8.5.7.CF201612"
},
{
"version_value": "8.5.7.CF201609"
},
{
"version_value": "8.5.7.CF201606"
},
{
"version_value": "8.5.7"
},
{
"version_value": "8.5.6.2"
},
{
"version_value": "8.5.6.1"
},
{
"version_value": "8.5.6"
},
{
"version_value": "8.6"
},
{
"version_value": "8.5.0.2"
},
{
"version_value": "8.5.0.1"
},
{
"version_value": "8.5"
},
{
"version_value": "8.0.1.3"
},
{
"version_value": "8.0.1.2"
},
{
"version_value": "8.0.1.1"
},
{
"version_value": "8.0.1"
},
{
"version_value": "8.0"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "19.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Bypass Security"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6205805",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6205805 (Business Process Manager Standard)",
"url": "https://www.ibm.com/support/pages/node/6205805"
},
{
"name": "ibm-bpm-cve20204446-weak-security (181126)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181126"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4446",
"datePublished": "2020-05-06T13:45:19.952281Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-16T20:06:31.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-24957
Vulnerability from cvelistv5
Published
2023-05-06 02:05
Modified
2024-08-02 11:11
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6965776 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/246115 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:11:43.746Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6965776"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/246115"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115."
}
],
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-06T02:05:46.959Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6965776"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/246115"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-24957",
"datePublished": "2023-05-06T02:05:46.959Z",
"dateReserved": "2023-02-01T02:39:37.386Z",
"dateUpdated": "2024-08-02T11:11:43.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1999
Vulnerability from cvelistv5
Published
2019-04-08 14:50
Modified
2024-09-16 20:48
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10870502 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/154889 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:39.542Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870502"
},
{
"name": "ibm-bpm-cve20181999-info-disc (154889)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154889"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
}
]
}
],
"datePublic": "2019-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.8,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/S:U/UI:N/AC:L/C:L/PR:L/A:N/I:N/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-08T14:50:37",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870502"
},
{
"name": "ibm-bpm-cve20181999-info-disc (154889)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154889"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-04-04T00:00:00",
"ID": "CVE-2018-1999",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10870502",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 870502 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870502"
},
{
"name": "ibm-bpm-cve20181999-info-disc (154889)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154889"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1999",
"datePublished": "2019-04-08T14:50:37.999223Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T20:48:14.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-43188
Vulnerability from cvelistv5
Published
2024-09-18 11:39
Modified
2024-09-18 16:40
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow
22.0.2, 23.0.1, 23.0.2, and 24.0.0
could allow a privileged user to perform unauthorized activities due to improper client side validation.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/7168769 | vendor-advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 22.0.2, 23.0.1, 23.0.2, 24.0.0 cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:* cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:* cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:-:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:-:*:*:* |
|
|
|||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43188",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T13:23:48.735450Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T13:23:58.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:*",
"cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:*",
"cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:-:*:*:*",
"cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:-:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "22.0.2, 23.0.1, 23.0.2, 24.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM Business Automation Workflow \n\n\u003cspan style=\"background-color: rgb(244, 244, 244);\"\u003e22.0.2, 23.0.1, 23.0.2, and 24.0.0\u003c/span\u003e\n\ncould allow a privileged user to perform unauthorized activities due to improper client side validation.\u003c/span\u003e"
}
],
"value": "IBM Business Automation Workflow \n\n22.0.2, 23.0.1, 23.0.2, and 24.0.0\n\ncould allow a privileged user to perform unauthorized activities due to improper client side validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-602",
"description": "CWE-602 Client-Side Enforcement of Server-Side Security",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:40:53.717Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7168769"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow improper input validation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-43188",
"datePublished": "2024-09-18T11:39:22.958Z",
"dateReserved": "2024-08-07T13:29:34.029Z",
"dateUpdated": "2024-09-18T16:40:53.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29878
Vulnerability from cvelistv5
Published
2021-10-18 16:35
Modified
2024-09-17 01:36
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6501949 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/206581 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 Version: 19.0.0.2 Version: 19.0.0.3 Version: 20.0.0.1 Version: 20.0.0.2 Version: 21.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:03.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6501949"
},
{
"name": "ibm-baw-cve202129878-xss (206581)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206581"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.3"
},
{
"status": "affected",
"version": "20.0.0.1"
},
{
"status": "affected",
"version": "20.0.0.2"
},
{
"status": "affected",
"version": "21.0.2"
}
]
}
],
"datePublic": "2021-10-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/A:N/UI:R/PR:L/I:L/S:C/AV:N/C:L/AC:L/RL:O/RC:C/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-18T16:35:11",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6501949"
},
{
"name": "ibm-baw-cve202129878-xss (206581)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206581"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-10-15T00:00:00",
"ID": "CVE-2021-29878",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.2"
},
{
"version_value": "19.0.0.3"
},
{
"version_value": "20.0.0.1"
},
{
"version_value": "20.0.0.2"
},
{
"version_value": "21.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6501949",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6501949 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6501949"
},
{
"name": "ibm-baw-cve202129878-xss (206581)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206581"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29878",
"datePublished": "2021-10-18T16:35:11.354598Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-17T01:36:37.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4768
Vulnerability from cvelistv5
Published
2021-02-11 16:30
Modified
2024-09-16 16:33
Severity ?
EPSS score ?
Summary
IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6414377 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/188907 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0 Version: 19.0 Version: 20.0 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:14:59.005Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6414377"
},
{
"name": "ibm-baw-cve20204768-xss (188907)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188907"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
}
]
},
{
"product": "Case Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.3"
}
]
}
],
"datePublic": "2021-02-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 4.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/UI:R/C:L/S:C/PR:L/A:N/AV:N/I:L/AC:H/RC:C/E:H/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-11T16:30:28",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6414377"
},
{
"name": "ibm-baw-cve20204768-xss (188907)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188907"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-02-10T00:00:00",
"ID": "CVE-2020-4768",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
}
]
}
},
{
"product_name": "Case Manager",
"version": {
"version_data": [
{
"version_value": "5.2"
},
{
"version_value": "5.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6414377",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6414377 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6414377"
},
{
"name": "ibm-baw-cve20204768-xss (188907)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188907"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4768",
"datePublished": "2021-02-11T16:30:28.795523Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-16T16:33:02.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4698
Vulnerability from cvelistv5
Published
2020-09-08 14:30
Modified
2024-09-17 00:42
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6326825 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/186841 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:14:58.141Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6326825"
},
{
"name": "ibm-baw-cve20204698-xss (186841)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186841"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
}
]
}
],
"datePublic": "2020-09-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 6.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:L/S:C/C:L/AV:N/PR:L/A:N/UI:N/I:L/RC:C/E:H/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-08T14:30:24",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6326825"
},
{
"name": "ibm-baw-cve20204698-xss (186841)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186841"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-09-04T00:00:00",
"ID": "CVE-2020-4698",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "N"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6326825",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6326825 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6326825"
},
{
"name": "ibm-baw-cve20204698-xss (186841)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186841"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4698",
"datePublished": "2020-09-08T14:30:24.573487Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T00:42:27.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1997
Vulnerability from cvelistv5
Published
2019-04-08 14:50
Modified
2024-09-16 23:52
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10794831 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/154774 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:39.653Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
},
{
"name": "ibm-baw-cve20181997-dos (154774)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
}
]
}
],
"datePublic": "2019-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.8,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:L/PR:L/I:N/AC:L/C:N/S:U/UI:N/AV:N/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of Service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-08T14:50:37",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
},
{
"name": "ibm-baw-cve20181997-dos (154774)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-04-04T00:00:00",
"ID": "CVE-2018-1997",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "N",
"I": "N",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10794831",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 794831 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
},
{
"name": "ibm-baw-cve20181997-dos (154774)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1997",
"datePublished": "2019-04-08T14:50:37.952252Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T23:52:15.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29751
Vulnerability from cvelistv5
Published
2021-06-28 15:55
Modified
2024-09-17 02:47
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6465127 | x_refsource_CONFIRM | |
| https://www.ibm.com/support/pages/node/6467055 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/201779 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.5 Version: 8.6 |
||||||||
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:02.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6467055"
},
{
"name": "ibm-baw-cve202129751-info-disc (201779)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0"
},
{
"status": "affected",
"version": "19.0"
},
{
"status": "affected",
"version": "20.0"
}
]
},
{
"product": "Cloud Pak for Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "20.0.3.IF002"
},
{
"status": "affected",
"version": "21.0.1"
}
]
}
],
"datePublic": "2021-06-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 2.7,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/C:L/UI:N/S:U/AV:N/PR:L/I:N/AC:H/A:N/E:U/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-28T15:55:25",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6467055"
},
{
"name": "ibm-baw-cve202129751-info-disc (201779)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-06-25T00:00:00",
"ID": "CVE-2021-29751",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0"
},
{
"version_value": "19.0"
},
{
"version_value": "20.0"
}
]
}
},
{
"product_name": "Cloud Pak for Automation",
"version": {
"version_data": [
{
"version_value": "20.0.3.IF002"
},
{
"version_value": "21.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "N",
"C": "L",
"I": "N",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6465127",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6465127 (Cloud Pak for Automation)",
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"name": "https://www.ibm.com/support/pages/node/6467055",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6467055 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6467055"
},
{
"name": "ibm-baw-cve202129751-info-disc (201779)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29751",
"datePublished": "2021-06-28T15:55:25.283945Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-17T02:47:11.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-39046
Vulnerability from cvelistv5
Published
2022-03-18 15:40
Modified
2024-09-16 22:02
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6564387 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/214346 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 Version: 19.0.0.2 Version: 19.0.0.3 Version: 20.0.0.1 Version: 20.0.0.2 Version: 21.0.2 Version: 21.0.3 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:17.584Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6564387"
},
{
"name": "ibm-baw-cve202139046-info-disc (214346)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.3"
},
{
"status": "affected",
"version": "20.0.0.1"
},
{
"status": "affected",
"version": "20.0.0.2"
},
{
"status": "affected",
"version": "21.0.2"
},
{
"status": "affected",
"version": "21.0.3"
}
]
},
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
}
]
}
],
"datePublic": "2022-03-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:N/PR:H/AC:L/S:U/AV:N/A:N/UI:N/C:H/E:U/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T15:40:16",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6564387"
},
{
"name": "ibm-baw-cve202139046-info-disc (214346)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2022-03-17T00:00:00",
"ID": "CVE-2021-39046",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.2"
},
{
"version_value": "19.0.0.3"
},
{
"version_value": "20.0.0.1"
},
{
"version_value": "20.0.0.2"
},
{
"version_value": "21.0.2"
},
{
"version_value": "21.0.3"
}
]
}
},
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.5"
},
{
"version_value": "8.6"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "H",
"I": "N",
"PR": "H",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6564387",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6564387 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6564387"
},
{
"name": "ibm-baw-cve202139046-info-disc (214346)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-39046",
"datePublished": "2022-03-18T15:40:16.124913Z",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-09-16T22:02:31.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-50947
Vulnerability from cvelistv5
Published
2024-02-04 00:11
Modified
2024-08-22 17:41
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/7114419 | vendor-advisory | |
| https://www.ibm.com/support/pages/node/7114430 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/275665 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 22.0.2, 23.0.1, 23.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:23:44.041Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50947",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-22T17:40:47.403078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T17:41:47.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "22.0.2, 23.0.1, 23.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665."
}
],
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-04T00:11:02.465Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-50947",
"datePublished": "2024-02-04T00:11:02.465Z",
"dateReserved": "2023-12-16T19:35:35.358Z",
"dateUpdated": "2024-08-22T17:41:47.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4672
Vulnerability from cvelistv5
Published
2020-11-16 16:40
Modified
2024-09-17 04:20
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6367813 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/186285 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 20.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:49.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6367813"
},
{
"name": "ibm-baw-cve20204672-xss (186285)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186285"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "20.0.0.1"
}
]
}
],
"datePublic": "2020-11-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/C:L/PR:L/A:N/I:L/S:C/UI:R/AC:L/AV:N/RL:O/E:H/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-16T16:40:36",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6367813"
},
{
"name": "ibm-baw-cve20204672-xss (186285)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186285"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-11-13T00:00:00",
"ID": "CVE-2020-4672",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "20.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6367813",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6367813 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/pages/node/6367813"
},
{
"name": "ibm-baw-cve20204672-xss (186285)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186285"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4672",
"datePublished": "2020-11-16T16:40:36.334214Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T04:20:42.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-4490
Vulnerability from cvelistv5
Published
2020-05-29 13:10
Modified
2024-09-17 03:38
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6217550 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/181989 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Business Process Manager Advanced |
Version: 8.0 Version: 8.0.1 Version: 8.0.1.1 Version: 8.0.1.2 Version: 8.5 Version: 8.5.0.1 Version: 8.5.5 Version: 8.0.1.3 Version: 8.5.6 Version: 8.5.0.2 Version: 8.5.7 Version: 8.5.7.CF201609 Version: 8.5.6.1 Version: 8.5.6.2 Version: 8.5.7.CF201606 Version: 8.5.7.CF201612 Version: 8.5.7.CF201703 Version: 8.5.7.CF201706 Version: 8.6 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6217550"
},
{
"name": "ibm-baw-cve20204490-sec-bypass (181989)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181989"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager Advanced",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.1.1"
},
{
"status": "affected",
"version": "8.0.1.2"
},
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.5.0.1"
},
{
"status": "affected",
"version": "8.5.5"
},
{
"status": "affected",
"version": "8.0.1.3"
},
{
"status": "affected",
"version": "8.5.6"
},
{
"status": "affected",
"version": "8.5.0.2"
},
{
"status": "affected",
"version": "8.5.7"
},
{
"status": "affected",
"version": "8.5.7.CF201609"
},
{
"status": "affected",
"version": "8.5.6.1"
},
{
"status": "affected",
"version": "8.5.6.2"
},
{
"status": "affected",
"version": "8.5.7.CF201606"
},
{
"status": "affected",
"version": "8.5.7.CF201612"
},
{
"status": "affected",
"version": "8.5.7.CF201703"
},
{
"status": "affected",
"version": "8.5.7.CF201706"
},
{
"status": "affected",
"version": "8.6"
}
]
},
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "19.0.0.0"
}
]
}
],
"datePublic": "2020-05-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/UI:R/S:U/AV:N/PR:N/A:N/AC:H/I:H/C:N/E:U/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Bypass Security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-05-29T13:10:20",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6217550"
},
{
"name": "ibm-baw-cve20204490-sec-bypass (181989)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181989"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-05-28T00:00:00",
"ID": "CVE-2020-4490",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager Advanced",
"version": {
"version_data": [
{
"version_value": "8.0"
},
{
"version_value": "8.0.1"
},
{
"version_value": "8.0.1.1"
},
{
"version_value": "8.0.1.2"
},
{
"version_value": "8.5"
},
{
"version_value": "8.5.0.1"
},
{
"version_value": "8.5.5"
},
{
"version_value": "8.0.1.3"
},
{
"version_value": "8.5.6"
},
{
"version_value": "8.5.0.2"
},
{
"version_value": "8.5.7"
},
{
"version_value": "8.5.7.CF201609"
},
{
"version_value": "8.5.6.1"
},
{
"version_value": "8.5.6.2"
},
{
"version_value": "8.5.7.CF201606"
},
{
"version_value": "8.5.7.CF201612"
},
{
"version_value": "8.5.7.CF201703"
},
{
"version_value": "8.5.7.CF201706"
},
{
"version_value": "8.6"
}
]
}
},
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "19.0.0.0"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989"
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "N",
"C": "N",
"I": "H",
"PR": "N",
"S": "U",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Bypass Security"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6217550",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6217550 (Business Process Manager Advanced)",
"url": "https://www.ibm.com/support/pages/node/6217550"
},
{
"name": "ibm-baw-cve20204490-sec-bypass (181989)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181989"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4490",
"datePublished": "2020-05-29T13:10:20.704929Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T03:38:56.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-38321
Vulnerability from cvelistv5
Published
2024-08-03 13:34
Modified
2024-08-03 18:49
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/7162334 | vendor-advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 | vdb-entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 22.0.2, 23.0.1, 23.0.2, 24.0.0 cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:* cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:* cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:-:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:-:*:*:* |
|
|
|||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-03T18:49:18.410755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-03T18:49:24.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:*",
"cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:*",
"cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:-:*:*:*",
"cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:-:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "22.0.2, 23.0.1, 23.0.2, 24.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868."
}
],
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-03T13:34:16.845Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7162334"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow information disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-38321",
"datePublished": "2024-08-03T13:34:16.845Z",
"dateReserved": "2024-06-13T21:43:46.667Z",
"dateUpdated": "2024-08-03T18:49:24.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-4424
Vulnerability from cvelistv5
Published
2019-08-20 19:30
Modified
2024-09-17 03:55
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/docview.wss?uid=ibm10959537 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 Version: 18.0.0.2 Version: 19.0.0.1 Version: 19.0.0.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:33:38.202Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959537"
},
{
"name": "ibm-baw-cve20194424-xxe (162770)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162770"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
},
{
"status": "affected",
"version": "18.0.0.2"
},
{
"status": "affected",
"version": "19.0.0.1"
},
{
"status": "affected",
"version": "19.0.0.2"
}
]
}
],
"datePublic": "2019-08-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/S:U/AV:N/C:H/AC:L/PR:L/UI:N/I:N/A:L/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-20T19:30:25",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959537"
},
{
"name": "ibm-baw-cve20194424-xxe (162770)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162770"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-08-06T00:00:00",
"ID": "CVE-2019-4424",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
},
{
"version_value": "18.0.0.2"
},
{
"version_value": "19.0.0.1"
},
{
"version_value": "19.0.0.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "H",
"I": "N",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10959537",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 959537 (Business Automation Workflow)",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959537"
},
{
"name": "ibm-baw-cve20194424-xxe (162770)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162770"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4424",
"datePublished": "2019-08-20T19:30:25.574679Z",
"dateReserved": "2019-01-03T00:00:00",
"dateUpdated": "2024-09-17T03:55:04.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2019-04-08 15:29
Modified
2024-11-21 04:00
Severity ?
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/154889 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10870502 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/154889 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10870502 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
"matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
"matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow en las versiones 18.0.0.0, 18.0.0.1 y 18.0.0.2, podr\u00eda revelar informaci\u00f3n confidencial de la versi\u00f3n sobre el servidor desde p\u00e1ginas de error que podr\u00edan ayudar a un atacante en futuros ataques contra el sistema. ID de IBM X-Force: 154889."
}
],
"id": "CVE-2018-1999",
"lastModified": "2024-11-21T04:00:43.357",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-08T15:29:00.920",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154889"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870502"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154889"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870502"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-02-11 17:15
Modified
2024-11-21 05:33
Severity ?
Summary
IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/188907 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6414377 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/188907 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6414377 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | case_manager | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "19DD36C7-E89E-4EB1-9DC9-873AB5640BCF",
"versionEndIncluding": "20.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:case_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2BA3F1E7-FCDE-4936-A200-CE503D81543C",
"versionEndIncluding": "5.3.3",
"versionStartIncluding": "5.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907."
},
{
"lang": "es",
"value": "IBM Case Manager versiones 5.2 y 5.3 e IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0, son vulnerables a ataques de tipo cross-site scripting.\u0026#xa0;Esta vulnerabilidad permite a los usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista que puede conllevar a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza.\u0026#xa0;IBM X-Force ID: 188907"
}
],
"id": "CVE-2020-4768",
"lastModified": "2024-11-21T05:33:13.550",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-02-11T17:15:13.013",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188907"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6414377"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188907"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6414377"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-09-20 15:29
Modified
2024-11-21 04:00
Severity ?
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.securitytracker.com/id/1041717 | Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/145109 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10720035 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1041717 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/145109 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10720035 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "00DC7609-2519-4DB5-AA5E-A1CFCE0DA5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:advanced:*:*:*",
"matchCriteriaId": "5FD533D8-D3B2-4661-BD35-C48C1C3C47E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:express:*:*:*",
"matchCriteriaId": "32F2F148-4CF2-46BF-AA7D-D019CBA72C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:standard:*:*:*",
"matchCriteriaId": "D67D59BD-B0B2-47A8-8045-7C62721EA081",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8F88ED9A-7D7F-4C1F-87AA-555C941DE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8736CAA3-7C69-4F8D-936B-2B7B3B5DEED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "CD9103EF-29E7-48E6-ADF4-66D74C3FF427",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:express:*:*:*",
"matchCriteriaId": "BD42A0F7-540B-4673-AD8C-373A424A27B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "542E8F0D-8326-48E1-9D72-C61EF104573D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:express:*:*:*",
"matchCriteriaId": "A66AA55B-BA7F-4C89-BCFE-7F3527FF0350",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109."
},
{
"lang": "es",
"value": "IBM Business Process Manager, de la versi\u00f3n 8.5 a la 8.6 y de la versi\u00f3n 18.0.0.0 a la 18.0.0.1, es vulnerable a una in. Un atacante remoto podr\u00eda enviar instrucciones SQL especialmente manipuladas que podr\u00edan permitir que el atacante viese, a\u00f1adiese, modificase o borrase informaci\u00f3n en la base de datos del backend. IBM X-Force ID: 145109."
}
],
"id": "CVE-2018-1674",
"lastModified": "2024-11-21T04:00:11.080",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-09-20T15:29:00.303",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041717"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/145109"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10720035"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/145109"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10720035"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-12-13 16:15
Modified
2024-11-21 04:43
Severity ?
Summary
The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/162772 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/1116087 | Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/1135552 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/162772 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/1116087 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/1135552 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | case_manager | * | |
| ibm | case_manager | 5.1.1 | |
| ibm | case_manager | 5.2.0 | |
| ibm | case_manager | 5.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4595F3-14A9-4AF2-8E2D-FB4A9B7B56F2",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:case_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0B2BA7B5-012B-43A8-B6BC-58530BC94119",
"versionEndExcluding": "5.3.2",
"versionStartIncluding": "5.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:case_manager:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F6936BE0-048E-4139-845A-691D6AA91D7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:case_manager:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "70870277-753E-4E90-B6F1-28023B98E19D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:case_manager:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EEA085E9-2791-4070-8E78-768802610EE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772."
},
{
"lang": "es",
"value": "El componente Case Builder entregado con versiones 18.0.0.1 hasta 19.0.0.2 e IBM Case Manager versiones 5.1.1 hasta 5.3, es vulnerable a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 162772."
}
],
"id": "CVE-2019-4426",
"lastModified": "2024-11-21T04:43:35.587",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-12-13T16:15:11.760",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162772"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/1116087"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/1135552"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162772"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/1116087"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/1135552"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-12-17 17:15
Modified
2024-11-21 06:18
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/209165 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6527270 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/209165 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6527270 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.1 | |
| ibm | business_automation_workflow | 19.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.3 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 21.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.5.0.1 | |
| ibm | business_process_manager | 8.5.0.2 | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "4716C07D-A372-47CC-BDE8-FEBBC8EDB919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "783C2592-9669-4C75-9E63-C834482F6F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06BDD35B-B0C3-4B90-87E3-19EF561D3722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0, 20,0 y 21.0 e IBM Business Process Manager versiones 8.5 y 8.6, son vulnerables a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista y conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 209165"
}
],
"id": "CVE-2021-38883",
"lastModified": "2024-11-21T06:18:08.877",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-12-17T17:15:13.053",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209165"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6527270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209165"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6527270"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-17 18:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/182716 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6233276 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/182716 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6233276 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 19.0.0.3 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5D88BD08-CE33-4E18-B01E-CA5D7070077D",
"versionEndExcluding": "8.5.7.0",
"versionStartIncluding": "8.5.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow e IBM Business Process Manager (IBM Business Process Manager Express versiones 8.5.5, 8.5.6, 8.5.7 y 8.6), podr\u00edan permitir a un atacante remoto obtener informaci\u00f3n confidencial cuando se devuelve un mensaje de error t\u00e9cnico detallado en el navegador. Esta informaci\u00f3n podr\u00eda ser usada en futuros ataques contra el sistema. ID de IBM X-Force: 182716"
}
],
"id": "CVE-2020-4532",
"lastModified": "2024-11-21T05:32:51.560",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-17T18:15:12.220",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182716"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6233276"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182716"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6233276"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-10-18 17:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/206581 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6501949 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/206581 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6501949 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.1 | |
| ibm | business_automation_workflow | 19.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.3 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 21.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "068CE38A-FBC4-43BF-BD1D-F65F9ADC5141",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0, 20.0 y 21.0, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista y conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 206581"
}
],
"id": "CVE-2021-29878",
"lastModified": "2024-11-21T06:01:57.290",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-10-18T17:15:07.860",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206581"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6501949"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206581"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6501949"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-29 13:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/181989 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6217550 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/181989 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6217550 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_process_manager | 8.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "161542A0-E919-4105-AD4F-C881ACF8D26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989"
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18 y 19, e IBM Business Process Manager versiones 8.0, 8.5 y 8.6, podr\u00edan permitir a un atacante remoto omitir restricciones de seguridad, causadas por un fallo de tabnabbing inverso. Un atacante podr\u00eda explotar esta vulnerabilidad y redirigir una victima hacia un sitio de phishing. IBM X-Force ID: 181989"
}
],
"id": "CVE-2020-4490",
"lastModified": "2024-11-21T05:32:48.157",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-29T13:15:09.720",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181989"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6217550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181989"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6217550"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-10-22 19:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/204833 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6507319 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/204833 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6507319 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_automation_workflow | 21.0.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2E3A6A15-0C11-4982-B041-32C1EDA1CDA7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0, 20.0 y 21.0, es vulnerable a una ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista y conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 204833"
}
],
"id": "CVE-2021-29835",
"lastModified": "2024-11-21T06:01:53.567",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-10-22T19:15:07.653",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204833"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6507319"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204833"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6507319"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-08 15:29
Modified
2024-11-21 04:00
Severity ?
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/154774 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10794831 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/154774 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10794831 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
"matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
"matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
},
{
"lang": "es",
"value": "Business Automation Workflow y Business Process Manager de IBM en las versiones 18.0.0.0, 18.0.0.1 y 18.0.0.2 son vulnerables a un ataque de denegaci\u00f3n de servicio. Un atacante autenticado puede enviar una petici\u00f3n especialmente creada que agote la memoria del lado del servidor. ID de IBM X-Force: 154774."
}
],
"id": "CVE-2018-1997",
"lastModified": "2024-11-21T04:00:43.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-08T15:29:00.873",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-01-04 00:15
Modified
2024-11-21 07:24
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/238054 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6852217 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/238054 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6852217 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBA0B449-9C87-40A1-A751-D7CB7500C95B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9518076E-2A41-409A-BB38-23E68392C57F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CB74871E-27A9-40BB-8D55-45E00CF858DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5809E8E5-A954-4E65-A594-582A56680FA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5B8D494-90DD-42AA-8D83-264C5B63CF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7CD38048-750C-4141-8A52-DB4071D38270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E33C724D-CA76-46DF-B397-7874AE12F14B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8E6A7059-10C5-48FC-9A3E-FCEA5CF3903F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "451CB880-C26B-4A39-AD06-73A6BD13973F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E0F9C5-ACBB-42FE-BDC6-96BF3492C7DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if001:*:*:*:*:*:*",
"matchCriteriaId": "6503FA0A-D948-47A4-9DEE-D58910E52EB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if002:*:*:*:*:*:*",
"matchCriteriaId": "69E56B42-5F7C-451D-92CE-3D2437BABF62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if003:*:*:*:*:*:*",
"matchCriteriaId": "A72358A4-1871-4EDF-851B-488D5E90BD4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if004:*:*:*:*:*:*",
"matchCriteriaId": "23047A79-1A03-4D55-8343-83F04379BF9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if005:*:*:*:*:*:*",
"matchCriteriaId": "D0CFF4A6-3622-47E7-8DAD-92FD6A0244CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if006:*:*:*:*:*:*",
"matchCriteriaId": "6DFBAF79-67A2-4BA2-A13D-28F7C69630A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:if007:*:*:*:*:*:*",
"matchCriteriaId": "89601534-F374-48A4-9848-959B48B3414A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "068CE38A-FBC4-43BF-BD1D-F65F9ADC5141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if001:*:*:*:*:*:*",
"matchCriteriaId": "571A6ACF-E38E-4FDE-A32E-3DDA18D17316",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if002:*:*:*:*:*:*",
"matchCriteriaId": "66AA5938-DADC-47BE-BBE0-31B349631E32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if003:*:*:*:*:*:*",
"matchCriteriaId": "B75749E3-C4A0-49FD-9725-4F5514535284",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if004:*:*:*:*:*:*",
"matchCriteriaId": "417A01BE-CC6D-4A54-A121-17EDB7BF1646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if005:*:*:*:*:*:*",
"matchCriteriaId": "F6756C93-B5A1-4A47-94B5-E9623212BD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if006:*:*:*:*:*:*",
"matchCriteriaId": "4784BE72-DA3D-4567-AA2A-49ABA7D2F066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if007:*:*:*:*:*:*",
"matchCriteriaId": "B92DC009-0997-4325-8469-CAB2F963163C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if008:*:*:*:*:*:*",
"matchCriteriaId": "07B373A3-09FA-4650-A6D9-1412C5475622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if009:*:*:*:*:*:*",
"matchCriteriaId": "5C0A9A11-0700-4254-B6AE-558A86E03F48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if010:*:*:*:*:*:*",
"matchCriteriaId": "96AACA6A-4CE6-41EA-9906-04E05BD75D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if011:*:*:*:*:*:*",
"matchCriteriaId": "1B1AA6DF-E73A-4A75-863C-BD116AE917F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:if012:*:*:*:*:*:*",
"matchCriteriaId": "F3B4C2BF-9BD4-4E99-8E2F-6396D59E68EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "EFE1F088-FAE8-48A9-AEBE-738CB97F984B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if001:*:*:*:*:*:*",
"matchCriteriaId": "DCF074C0-7CE9-42B4-82BA-662662F7E3CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:*:*:*:*",
"matchCriteriaId": "74DF0590-C1C3-4E46-B1D9-5AEA5767C0FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if003:*:*:*:*:*:*",
"matchCriteriaId": "4DAA3F18-B2E8-4D91-95B1-BB1C91720790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if004:*:*:*:*:*:*",
"matchCriteriaId": "529728C6-944C-4DD1-979F-F6E9F02FB36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:*:*:*:*",
"matchCriteriaId": "00076887-2AF4-4B5B-870A-442E8AF686F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:*:*:*:*",
"matchCriteriaId": "FCE5369D-16E2-440E-A97D-8DABCFE9C617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:*:*:*:*",
"matchCriteriaId": "C41005B8-3D7B-4BF1-83AC-A6816281E0F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:*:*:*:*",
"matchCriteriaId": "82AB2F91-CC3E-4D60-9BA1-0174E70E3DB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:*:*:*:*",
"matchCriteriaId": "B65FE877-1A93-4432-B335-A12FF7D6C3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:*:*:*:*",
"matchCriteriaId": "3276D80B-ABB7-41F1-A128-E89CC649EA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:*:*:*:*",
"matchCriteriaId": "3FD8A22F-A6C6-4674-B223-3A848C4FA2B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:*:*:*:*",
"matchCriteriaId": "66EC4C8C-BBBF-4878-AF07-3E9CA8A1FD20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:*:*:*:*",
"matchCriteriaId": "EBA97707-1843-45B3-911B-7C6EBAFFDC4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:*:*:*:*",
"matchCriteriaId": "7929C8E9-08F8-49C3-8E41-2B735052CB9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:*:*:*:*",
"matchCriteriaId": "3F9D2173-471A-460F-86B4-1F8C2A485B2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F1AC8187-347E-4A40-A0FA-B68AFFAA9F2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if001:*:*:*:*:*:*",
"matchCriteriaId": "65D1A1BA-657B-43CD-9718-1D7A8D5223C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if002:*:*:*:*:*:*",
"matchCriteriaId": "AE3823AF-8942-4B9C-8D19-E5DEAC7FBFCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if003:*:*:*:*:*:*",
"matchCriteriaId": "7E8044CD-FB8B-48E8-9B4B-86BC9A25D3D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if004:*:*:*:*:*:*",
"matchCriteriaId": "9427CF82-1EE3-4B54-9D20-B45D5452145D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if005:*:*:*:*:*:*",
"matchCriteriaId": "18B67072-F540-4131-A133-552AF68D0FD3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nIBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054.\n\n"
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0. 3 y 22.0.1 es vulnerable a Cross Site Request Forgery, lo que podr\u00eda permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas por un usuario en el que conf\u00eda el sitio web. ID de IBM X-Force: 238054."
}
],
"id": "CVE-2022-42435",
"lastModified": "2024-11-21T07:24:57.990",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-01-04T00:15:10.077",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/238054"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6852217"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/238054"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6852217"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-12-21 19:15
Modified
2024-11-21 06:18
Severity ?
Summary
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/209512 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6526488 | Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6527782 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/209512 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6526488 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6527782 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_automation_workflow | 21.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | workflow_process_service | 21.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "4716C07D-A372-47CC-BDE8-FEBBC8EDB919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:standard:*:*:*",
"matchCriteriaId": "25AFA35A-B7BC-430C-8AF9-73653E6D36B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:standard:*:*:*",
"matchCriteriaId": "6E9348B4-025E-4A86-A3B5-616840F28B58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:standard:*:*:*",
"matchCriteriaId": "1B8D6782-F9D8-4B89-8C1D-9BB8992BD89F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:workflow_process_service:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6DBD44DD-45DA-4453-8C78-810565251FD8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512."
},
{
"lang": "es",
"value": "IBM Business Process Manager versiones 8.5 y 8.6 e IBM Business Automation Workflow versiones 18.0, 19.0, 20.0 y 21.0, son vulnerables a una ataque de tipo cross-site scripting almacenado. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista y conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 209512"
}
],
"id": "CVE-2021-38893",
"lastModified": "2024-11-21T06:18:09.757",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-12-21T19:15:07.713",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6526488"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6527782"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6526488"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6527782"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-01 15:15
Modified
2024-11-21 04:43
Severity ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.securityfocus.com/bid/108993 | Broken Link, Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/162657 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10888037 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/108993 | Broken Link, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/162657 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10888037 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3398C8C-DB87-4CBA-B1F4-97D62910790A",
"versionEndIncluding": "19.0.0.1",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "04D332A0-BEA8-4E22-A37C-1AC76B36ACDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*",
"matchCriteriaId": "71A849EF-53B1-4402-85BE-D75E4765AEAB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*",
"matchCriteriaId": "D2B1150A-E780-42BF-8D9E-77258C1D869A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0.0.0, 18.0.0.1, 18.0.0.2, y 19.0.0.1 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista que puede conllevar a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza. ID de IBM X-Force:162657."
}
],
"id": "CVE-2019-4410",
"lastModified": "2024-11-21T04:43:34.373",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-01T15:15:13.270",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/108993"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162657"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10888037"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/108993"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162657"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10888037"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-09-15 14:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/182714 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6332417 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/182714 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6332417 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "69206F5D-36AC-4E9A-B7B1-1C440C764CB4",
"versionEndExcluding": "20.0.0.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A09B2C9-90B3-417D-AE1B-B01FFCC40B66",
"versionEndExcluding": "8.0.1.0",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FF945A20-E944-4307-B60D-9C804C388935",
"versionEndExcluding": "8.5.7.0",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow CD0 e IBM Business Process Manager versiones 8.0, 8.5 y 8.6, son vulnerables a ataques de tipo cross-site scripting.\u0026#xa0;Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista conllevando a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable.\u0026#xa0;IBM X-Force ID: 182714"
}
],
"id": "CVE-2020-4530",
"lastModified": "2024-11-21T05:32:51.320",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-15T14:15:14.597",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182714"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6332417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182714"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6332417"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-08 15:29
Modified
2024-11-21 04:43
Severity ?
Summary
IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/156241 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10870494 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/156241 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10870494 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8A1C8F-793A-4F66-8217-70E16C5C832B",
"versionEndIncluding": "18.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*",
"matchCriteriaId": "D2B1150A-E780-42BF-8D9E-77258C1D869A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "04D332A0-BEA8-4E22-A37C-1AC76B36ACDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201712:*:*:*:*:*:*",
"matchCriteriaId": "F7B13D9D-E6BC-4621-A3F2-57F501DC97B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*",
"matchCriteriaId": "71A849EF-53B1-4402-85BE-D75E4765AEAB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241."
},
{
"lang": "es",
"value": "Business Automation Workflow y Business Process Manager de IBM en las versiones 18.0.0.0, 18.0.0.1 y 18.0.0.2 proporcionan funciones de gesti\u00f3n de documentos integradas. Debido a una falta de restricci\u00f3n en una API, un cliente podr\u00eda falsificar la \u00faltima modificaci\u00f3n mediante el valor de un documento. ID de IBM X-Force: 156241."
}
],
"id": "CVE-2019-4045",
"lastModified": "2024-11-21T04:43:04.880",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-08T15:29:02.217",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/156241"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870494"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/156241"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870494"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-03 20:15
Modified
2024-11-21 07:11
Severity ?
Summary
"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6829847 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6829847 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 21.0.1 | |
| ibm | business_automation_workflow | 21.0.2 | |
| ibm | business_automation_workflow | 21.0.2 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 21.0.3 | |
| ibm | business_automation_workflow | 22.0.1 | |
| ibm | business_automation_workflow | 22.0.1 | |
| ibm | business_automation_workflow | 22.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "EBA0D501-8535-4CAF-BFAD-88AC5E1FBA03",
"versionEndIncluding": "18.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "9BBBCE4C-7230-4CF5-A9BA-1BB8F479E433",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:-:*:*:containers:*:*:*",
"matchCriteriaId": "824ACC07-E351-437A-9FAB-7F2E47DE9205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:-:*:*:containers:*:*:*",
"matchCriteriaId": "485FFABA-EF59-4C36-8B6E-E32A99C02381",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "83966976-3307-4B4C-AE62-7BF040BEF0F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "B2A3E3AF-14A2-44E6-A17F-ACD63B010E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:-:*:*:containers:*:*:*",
"matchCriteriaId": "EB656C4F-19FC-4763-93C8-940A2B38B729",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D1DC801A-0F25-48D2-8465-31B5A0939EE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*",
"matchCriteriaId": "00F5E82D-712A-4AB2-B0B2-BF03507D17D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*",
"matchCriteriaId": "0063E78F-2978-43F6-884D-B375E1111E87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*",
"matchCriteriaId": "CF6317BE-98DF-4A46-9F5B-326177D6AD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*",
"matchCriteriaId": "72A22C4B-AAF2-4A84-AF39-C1C396031D98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*",
"matchCriteriaId": "39015A02-D36E-4CC9-A5E3-877DFD923ACD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*",
"matchCriteriaId": "19586E74-8802-4C09-A240-D698EE30C570",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*",
"matchCriteriaId": "4B06D109-E327-4A2A-9FC9-A5F454022C0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*",
"matchCriteriaId": "E67BEF93-133E-4507-B938-79D943AB82CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:-:*:*:containers:*:*:*",
"matchCriteriaId": "69B77521-AF61-4711-9219-12D6DADB6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if001:*:*:containers:*:*:*",
"matchCriteriaId": "E2AEA4BA-C309-4069-9226-B86C1B68F93C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537.\""
},
{
"lang": "es",
"value": "\"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3 y 22.0.1 podr\u00edan revelar informaci\u00f3n confidencial de la versi\u00f3n a usuarios autenticados que podr\u00eda usarse en futuros ataques contra el sistema. IBM X-Force ID: 230537.\""
}
],
"id": "CVE-2022-35279",
"lastModified": "2024-11-21T07:11:01.907",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-03T20:15:28.853",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6829847"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6829847"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-11-05 18:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/201919 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6513703 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/201919 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6513703 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_automation_workflow | 21.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "F6ED3777-F79B-4A0E-8E25-6721C61B54F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "535AE550-01A0-447C-8894-64A93C63047C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "04F6CF36-B3C9-41F3-8A2F-B2E8C4FD888F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "4716C07D-A372-47CC-BDE8-FEBBC8EDB919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "2E9CEC39-C2BF-4F43-86AD-4BFBB4915DE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18. 19, 20, 21, e IBM Business Process Manager 8.5 y d8.6, transmite o almacena credenciales de autenticaci\u00f3n, pero usa un m\u00e9todo no seguro que es susceptible de ser interceptado y/o recuperado sin autorizaci\u00f3n"
}
],
"id": "CVE-2021-29753",
"lastModified": "2024-11-21T06:01:44.517",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-11-05T18:15:09.253",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201919"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6513703"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201919"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6513703"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-319"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-08-03 14:15
Modified
2024-09-06 14:50
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 | Broken Link | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7162334 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:containers:*:*:*",
"matchCriteriaId": "AEB1C9C9-69C0-41CA-8FE8-9E2C142DC112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:containers:*:*:*",
"matchCriteriaId": "B9C41C12-BD6B-4E49-9BA4-288524FF55C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:containers:*:*:*",
"matchCriteriaId": "9FDDD905-95EA-4DCC-B359-7E6DAEFC537D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*",
"matchCriteriaId": "12725407-1B9F-43B7-8D66-F0E3B0181830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*",
"matchCriteriaId": "00F5E82D-712A-4AB2-B0B2-BF03507D17D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*",
"matchCriteriaId": "0063E78F-2978-43F6-884D-B375E1111E87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*",
"matchCriteriaId": "CF6317BE-98DF-4A46-9F5B-326177D6AD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*",
"matchCriteriaId": "72A22C4B-AAF2-4A84-AF39-C1C396031D98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*",
"matchCriteriaId": "39015A02-D36E-4CC9-A5E3-877DFD923ACD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*",
"matchCriteriaId": "19586E74-8802-4C09-A240-D698EE30C570",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*",
"matchCriteriaId": "4B06D109-E327-4A2A-9FC9-A5F454022C0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*",
"matchCriteriaId": "E67BEF93-133E-4507-B938-79D943AB82CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*",
"matchCriteriaId": "84689E35-3C11-44D2-B719-0F47CC7DE6B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*",
"matchCriteriaId": "05248E0A-BE7C-4AA1-80B8-5397382D742E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*",
"matchCriteriaId": "0852419C-62F1-49BA-BD99-96700D33ED64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:containers:*:*:*",
"matchCriteriaId": "628B7F15-103F-4B84-90ED-EBFAD633BCE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:*:*:containers:*:*:*",
"matchCriteriaId": "91E22A7B-18F4-461C-9986-0CECBAB879F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:*:*:containers:*:*:*",
"matchCriteriaId": "4FE832E4-BE4B-4923-A98D-3B127758C103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:*:*:containers:*:*:*",
"matchCriteriaId": "EE7E0724-C7FB-4436-A702-EC2102205175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if029:*:*:containers:*:*:*",
"matchCriteriaId": "40505E62-F229-45B5-8D22-30487471477C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if030:*:*:containers:*:*:*",
"matchCriteriaId": "D8E150F5-F27C-471C-A911-C2CC07E31EBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if031:*:*:containers:*:*:*",
"matchCriteriaId": "3F8FA6E0-01CF-458A-8AD3-3388BBA4FE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if032:*:*:containers:*:*:*",
"matchCriteriaId": "2CAF9596-964B-4E58-BB9D-07138F4566F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if033:*:*:containers:*:*:*",
"matchCriteriaId": "08853431-59B4-4730-88E3-812DF7B6691B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if034:*:*:containers:*:*:*",
"matchCriteriaId": "1BDB3D3C-1964-42F1-8035-2B4F2752E535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:containers:*:*:*",
"matchCriteriaId": "A157A0AD-B1AB-4FBB-AD00-348ADAE52173",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:containers:*:*:*",
"matchCriteriaId": "F2F5CF83-2F00-476D-BA79-5BD0AF71D929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:containers:*:*:*",
"matchCriteriaId": "AC67163F-742E-46BC-BF63-75F15F8D2DCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:containers:*:*:*",
"matchCriteriaId": "A99644F1-3E98-4156-B155-7FA642EA7BBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "1FD8E8F7-6B5F-4A21-90AF-483A8DFE4CFA",
"versionEndIncluding": "20.0.0.2",
"versionStartIncluding": "20.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "07308147-9441-4231-9BC0-231C3181F255",
"versionEndIncluding": "21.0.3.0",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "5CA224F7-AF29-4F8C-BD70-E9C0A7A2B366",
"versionEndIncluding": "22.0.2",
"versionStartIncluding": "22.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "A510FD89-9F92-4514-A706-52719EDC59E0",
"versionEndIncluding": "23.0.2",
"versionStartIncluding": "23.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "981B50AE-8B79-4E39-87AA-34DFA93B607A",
"versionEndIncluding": "23.0.2",
"versionStartIncluding": "23.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "3E9B8E36-CA86-459C-A0CF-F00F179119FD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2 y 24.0.0 almacena informaci\u00f3n potencialmente confidencial en archivos de registro en determinadas situaciones que un usuario autenticado podr\u00eda leer. ID de IBM X-Force: 284868."
}
],
"id": "CVE-2024-38321",
"lastModified": "2024-09-06T14:50:53.583",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-03T14:15:48.013",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Broken Link"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294868"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7162334"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-532"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-28 16:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/201779 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6465127 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6467055 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/201779 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6465127 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6467055 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versiones 8.5 y 8.6, podr\u00edan permitir a un usuario autenticado obtener informaci\u00f3n confidencial sobre otro usuario bajo configuraciones no predeterminadas. IBM X-Force ID: 201779"
}
],
"id": "CVE-2021-29751",
"lastModified": "2024-11-21T06:01:44.267",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-28T16:15:08.430",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6467055"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6467055"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-03-18 16:15
Modified
2024-11-21 06:18
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/214346 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6564387 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/214346 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6564387 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.1 | |
| ibm | business_automation_workflow | 19.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.3 | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 21.0.2 | |
| ibm | business_process_manager | 8.5 | |
| ibm | business_process_manager | 8.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "068CE38A-FBC4-43BF-BD1D-F65F9ADC5141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B72B33FC-40F4-48DF-AE36-E712F84CEE88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "63E512F2-F36A-42E8-AA7F-63994674731E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0, 20.0 y 21.0, e IBM Business Process Manager versiones 8.5 y 8.6, almacenan las credenciales de usuario en texto sin cifrar que puede leer un usuario privilegiado. IBM X-Force ID: 214346"
}
],
"id": "CVE-2021-39046",
"lastModified": "2024-11-21T06:18:29.110",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-18T16:15:08.403",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6564387"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6564387"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-17 17:15
Modified
2024-11-21 07:16
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/233978 | Broken Link, VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6839847 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/233978 | Broken Link, VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6839847 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 22.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "EBA0D501-8535-4CAF-BFAD-88AC5E1FBA03",
"versionEndIncluding": "18.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978."
},
{
"lang": "es",
"value": "Varias versiones de IBM Business Automation Workflow son vulnerables a Cross-Site Scripting. Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 233978."
}
],
"id": "CVE-2022-38390",
"lastModified": "2024-11-21T07:16:22.870",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-17T17:15:10.127",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Broken Link",
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233978"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6839847"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233978"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6839847"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-02-27 16:15
Modified
2024-11-21 04:43
Severity ?
Summary
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/171254 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/3552261 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/171254 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/3552261 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_automation_workflow | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:*:*:*:*",
"matchCriteriaId": "6D5823F5-B1A9-4695-9F45-04DCA899CA4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:*:*:*:*",
"matchCriteriaId": "9AC6A2C0-3CC1-4DF5-85CB-590565BB2398",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:*:*:*:*",
"matchCriteriaId": "660C60D1-BFFF-4A0C-A69A-4A6006C8D47E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:*:*:*:*",
"matchCriteriaId": "85F23471-D0B9-4D6F-891A-F847A6AAB21C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*",
"matchCriteriaId": "D2B1150A-E780-42BF-8D9E-77258C1D869A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "04D332A0-BEA8-4E22-A37C-1AC76B36ACDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2017.1:*:*:*:*:*:*",
"matchCriteriaId": "3BF3FFC7-8C7E-4D16-B86F-C4CB08013098",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
"matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1C87CD6B-8CB9-440A-AB91-68E6E42CDEB8",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "18.0.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254."
},
{
"lang": "es",
"value": "IBM Business Process Manager versiones 8.5.7.0 hasta 8.5.7.0 2017.06, versiones 8.6.0.0 hasta 8.6.0.0 CF2018.03, e IBM Business Automation Workflow versiones 18.0.0.1 hasta 19.0.0.3, es vulnerable a una inyecci\u00f3n SQL. Un atacante remoto podr\u00eda enviar sentencias SQL especialmente dise\u00f1adas, que podr\u00edan permitir al atacante visualizar, a\u00f1adir, modificar o eliminar informaci\u00f3n en la base de datos del back-end. IBM X-Force ID: 171254."
}
],
"id": "CVE-2019-4669",
"lastModified": "2024-11-21T04:43:57.353",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-02-27T16:15:10.977",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/171254"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/3552261"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/171254"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/3552261"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-08 15:29
Modified
2024-11-21 04:03
Severity ?
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.securityfocus.com/bid/107851 | Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/154890 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10870496 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/107851 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/154890 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10870496 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2017.12:*:*:*:*:*:*",
"matchCriteriaId": "24E8CD21-C017-4D4D-9CF6-8DDACFD7756E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
"matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 18.0.0.0 y 18.0.0.1 es vulnerable a Cross-Site Request Forgery (CSRF). Esto podr\u00eda permitir que un atacante ejecute acciones maliciosas y no autorizadas transmitidas transmitidas desde un usuario en el que la web conf\u00eda. IBM X-Force ID: 154890."
}
],
"id": "CVE-2018-2000",
"lastModified": "2024-11-21T04:03:34.483",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-08T15:29:00.997",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/107851"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154890"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870496"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/107851"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154890"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10870496"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-29 14:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/183611 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6241338 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/183611 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6241338 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versiones 8.5 y 8.6, son vulnerables a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 183611"
}
],
"id": "CVE-2020-4557",
"lastModified": "2024-11-21T05:32:54.060",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-29T14:15:12.303",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/183611"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6241338"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/183611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6241338"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-09-08 15:15
Modified
2024-11-21 05:33
Severity ?
Summary
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/186841 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6326825 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/186841 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6326825 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*",
"matchCriteriaId": "8578A0D7-3330-4F79-A934-4940673383A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "CC44A2D4-F3D3-4D98-8FDC-8274E1725800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:express:*:*:*",
"matchCriteriaId": "C28E7D30-82E5-4E46-8F4E-C4C11641D40C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:standard:*:*:*",
"matchCriteriaId": "9B7F2C25-331F-4733-92BD-7DC02B3378EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:express:*:*:*",
"matchCriteriaId": "28D39434-BC55-40CC-B02C-68C272C67013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "570E9DFF-F991-4D14-87F4-F7FE9554E58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*",
"matchCriteriaId": "ADE7414F-BF17-4415-95C3-FDBC2BC5C7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "E590C058-EC80-48FB-87C7-3F84E2BC07E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8736CAA3-7C69-4F8D-936B-2B7B3B5DEED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "CD9103EF-29E7-48E6-ADF4-66D74C3FF427",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:express:*:*:*",
"matchCriteriaId": "54C2CBF0-838B-4F7F-9E63-25053EC6D2E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:standard:*:*:*",
"matchCriteriaId": "A30BF550-893B-4F5D-B128-157655B6F8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:express:*:*:*",
"matchCriteriaId": "0D6B3497-1C02-43C0-8B73-9289F7FC00A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:standard:*:*:*",
"matchCriteriaId": "82E8F8FF-7C1E-4684-B479-BB3F8EA13B80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:express:*:*:*",
"matchCriteriaId": "7B136A70-552E-4545-853A-BAFD0919D52C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:standard:*:*:*",
"matchCriteriaId": "25AFA35A-B7BC-430C-8AF9-73653E6D36B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:express:*:*:*",
"matchCriteriaId": "94F5B156-9994-4A1A-A552-FA4108908883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:standard:*:*:*",
"matchCriteriaId": "6E9348B4-025E-4A86-A3B5-616840F28B58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:express:*:*:*",
"matchCriteriaId": "BD42A0F7-540B-4673-AD8C-373A424A27B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:standard:*:*:*",
"matchCriteriaId": "1B8D6782-F9D8-4B89-8C1D-9BB8992BD89F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:express:*:*:*",
"matchCriteriaId": "10DBD799-4712-42F1-8B03-88DAE9A685F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:standard:*:*:*",
"matchCriteriaId": "930CE10A-D6B0-423E-9450-AEDBF0A1E503",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841."
},
{
"lang": "es",
"value": "IBM Business Process Manager versiones 8.5, 8.6 e IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0, son vulnerables a ataques de tipo cross-site scripting almacenado. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 186841."
}
],
"id": "CVE-2020-4698",
"lastModified": "2024-11-21T05:33:08.603",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-08T15:15:12.117",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186841"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6326825"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186841"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6326825"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-08 15:29
Modified
2024-11-21 04:00
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.securityfocus.com/bid/107863 | Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10878106 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/107863 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10878106 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager_enterprise_service_bus | 8.6 | |
| ibm | websphere_enterprise_service_bus | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E2DFAA5-B9A9-42D3-81FA-0815AD7BEE1E",
"versionEndIncluding": "7.5.1.2",
"versionStartIncluding": "7.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
"matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
"matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager_enterprise_service_bus:8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5B4BF5A7-0250-415E-94C8-E440E58CB366",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere_enterprise_service_bus:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F0E50000-A948-4D59-A3AB-04F22AD29DB5",
"versionEndIncluding": "7.5.1.2",
"versionStartIncluding": "7.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow en sus versiones 18.0.0.0.0, 18.0.0.1 y 18.0.0.0.2 podr\u00eda permitir a un atacante no autenticado obtener informaci\u00f3n sensible, utilizando una petici\u00f3n HTTP especialmente comprimida. IBM X-Force ID: 152020."
}
],
"id": "CVE-2018-1885",
"lastModified": "2024-11-21T04:00:32.140",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-08T15:29:00.700",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/107863"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/107863"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-20 20:15
Modified
2024-11-21 04:43
Severity ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10959537 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10959537 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4BD15E1F-A2A1-4B07-9597-8FC9A3E47863",
"versionEndIncluding": "19.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E2DFAA5-B9A9-42D3-81FA-0815AD7BEE1E",
"versionEndIncluding": "7.5.1.2",
"versionStartIncluding": "7.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf01:*:*:*:*:*:*",
"matchCriteriaId": "038632B3-66AF-4F11-9834-BEDF269AB235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf02:*:*:*:*:*:*",
"matchCriteriaId": "30D2B29A-C262-4006-B004-085DA319AFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.06:*:*:*:*:*:*",
"matchCriteriaId": "51A3D3D0-45DE-4B42-8766-181793090845",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.09:*:*:*:*:*:*",
"matchCriteriaId": "BE3CB0E7-437F-4EFB-94AE-9325D2CC6005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.12:*:*:*:*:*:*",
"matchCriteriaId": "79A27F7F-9EAE-4E2B-B5E8-2C82380D9C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.03:*:*:*:*:*:*",
"matchCriteriaId": "3F268A9C-9E13-4573-A75E-308CA3193836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
"matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2017.12:*:*:-:*:*:*",
"matchCriteriaId": "82A2B33F-5E31-410A-BBE8-B400F928CC16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:-:*:*:*",
"matchCriteriaId": "2D312C42-2CB3-499A-8A74-997155811C6A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1 y 19.0.0.2 es vulnerable a un ataque de inyecci\u00f3n de entidadexterna XML (XXE) al procesar datos XML. Un atacante remoto podr\u00eda aprovechar esta vulnerabilidad para exponer informaci\u00f3n confidencial o consumir recursos de memoria. ID de IBM X-Force: 162770."
}
],
"id": "CVE-2019-4424",
"lastModified": "2024-11-21T04:43:35.337",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-20T20:15:13.917",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162770"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959537"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162770"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959537"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-611"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-05-10 15:29
Modified
2024-11-21 04:43
Severity ?
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3398C8C-DB87-4CBA-B1F4-97D62910790A",
"versionEndIncluding": "19.0.0.1",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.06:*:*:*:*:*:*",
"matchCriteriaId": "51A3D3D0-45DE-4B42-8766-181793090845",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.09:*:*:*:*:*:*",
"matchCriteriaId": "BE3CB0E7-437F-4EFB-94AE-9325D2CC6005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.12:*:*:*:*:*:*",
"matchCriteriaId": "79A27F7F-9EAE-4E2B-B5E8-2C82380D9C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.03:*:*:*:*:*:*",
"matchCriteriaId": "3F268A9C-9E13-4573-A75E-308CA3193836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
"matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*",
"matchCriteriaId": "71A849EF-53B1-4402-85BE-D75E4765AEAB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow, versiones 18.0.0.0.0.0, 18.0.0.1, 18.0.0.2 y 19.0.0.1, es vulnerable a los ataques XSS. Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario de la Web, alterando as\u00ed la funcionalidad prevista que puede conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza. IBM X-Force ID: 159125."
}
],
"id": "CVE-2019-4204",
"lastModified": "2024-11-21T04:43:18.623",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-10T15:29:02.760",
"references": [
{
"source": "psirt@us.ibm.com",
"url": "http://www.securityfocus.com/bid/108328"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159125"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880499"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/108328"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159125"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880499"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-14 16:29
Modified
2024-11-21 04:00
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.securityfocus.com/bid/106217 | Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/150947 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10743005 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106217 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/150947 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10743005 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | websphere | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E2DFAA5-B9A9-42D3-81FA-0815AD7BEE1E",
"versionEndIncluding": "7.5.1.2",
"versionStartIncluding": "7.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:*:*:*:*",
"matchCriteriaId": "6D5823F5-B1A9-4695-9F45-04DCA899CA4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:*:*:*:*",
"matchCriteriaId": "9AC6A2C0-3CC1-4DF5-85CB-590565BB2398",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:*:*:*:*",
"matchCriteriaId": "660C60D1-BFFF-4A0C-A69A-4A6006C8D47E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:*:*:*:*",
"matchCriteriaId": "85F23471-D0B9-4D6F-891A-F847A6AAB21C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*",
"matchCriteriaId": "D2B1150A-E780-42BF-8D9E-77258C1D869A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "04D332A0-BEA8-4E22-A37C-1AC76B36ACDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201712:*:*:*:*:*:*",
"matchCriteriaId": "F7B13D9D-E6BC-4621-A3F2-57F501DC97B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*",
"matchCriteriaId": "71A849EF-53B1-4402-85BE-D75E4765AEAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:*:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "F5A1C5CB-2E2F-4A18-9F37-75E0F304FA31",
"versionEndIncluding": "7.2.0.5",
"versionStartIncluding": "7.2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow en sus versiones 18.0.0.0 y 18.0.0.1 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. Esto podr\u00eda dar lugar a una revelaci\u00f3n de credenciales en una sesi\u00f3n de confianza. IBM X-Force ID: 150947."
}
],
"id": "CVE-2018-1848",
"lastModified": "2024-11-21T04:00:29.983",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-14T16:29:00.220",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-11-30 16:15
Modified
2024-11-21 05:33
Severity ?
Summary
IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/190991 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6373004 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/190991 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6373004 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 19.0.0.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versi\u00f3n 19.0.0.3, almacena informaci\u00f3n potencialmente confidencial en archivos de registro que un usuario local podr\u00eda leer.\u0026#xa0;IBM X-Force ID: 190991"
}
],
"id": "CVE-2020-4900",
"lastModified": "2024-11-21T05:33:23.710",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.4,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-11-30T16:15:13.827",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190991"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6373004"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190991"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6373004"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-532"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-28 16:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/203029 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6465127 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6467057 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/203029 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6465127 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6467057 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 19.0.0.3 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | cloud_pak_for_automation | 20.0.3-if002 | |
| ibm | cloud_pak_for_automation | 21.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.3-if002:*:*:*:*:*:*:*",
"matchCriteriaId": "876AA052-ECBF-4C44-863E-3EC31A8B3B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "18A895F5-B552-4BA2-869A-8125995C780E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 19.0.03 y 20.0 e IBM Cloud Pak for Automation versiones 20.0.3-IF002 y 21.0.1, son vulnerables a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista y conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 203029"
}
],
"id": "CVE-2021-29775",
"lastModified": "2024-11-21T06:01:47.133",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-28T16:15:08.487",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/203029"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6467057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/203029"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6467057"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-12-21 19:15
Modified
2024-11-21 06:18
Severity ?
Summary
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/209607 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6527776 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6528296 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/209607 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6527776 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6528296 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_automation_workflow | 21.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | workflow_process_service | 21.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "4716C07D-A372-47CC-BDE8-FEBBC8EDB919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:workflow_process_service:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6DBD44DD-45DA-4453-8C78-810565251FD8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607."
},
{
"lang": "es",
"value": "IBM Business Process Manager versiones 8.5 y 8.6, e IBM Business Automation Workflow versiones 18.0, 19.0, 20.0 y 21.0, podr\u00edan permitir a un usuario con privilegios conseguir informaci\u00f3n altamente confidencial debido a controles de acceso inapropiados. IBM X-Force ID: 209607"
}
],
"id": "CVE-2021-38900",
"lastModified": "2024-11-21T06:18:10.583",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-12-21T19:15:07.770",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209607"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6527776"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6528296"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6527776"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6528296"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-01-26 21:17
Modified
2024-11-21 07:27
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 22.0.1 | |
| ibm | business_automation_workflow | 22.0.2 | |
| ibm | business_monitor | 8.5.5 | |
| ibm | business_monitor | 8.5.6 | |
| ibm | business_monitor | 8.5.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DFB13BEC-206E-41B3-A4F3-9281EBB0E213",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_monitor:8.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B27F3476-A531-4B6C-86E1-1D0CCDF793E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_monitor:8.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "61F27962-673C-4501-AA15-182164FBB4BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_monitor:8.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "51681BF1-DFD8-40A5-B5A9-6A467A038621",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nIBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.\n\n"
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 22.0.2 podr\u00eda permitir que un atacante remoto atraviese directorios del sistema. Un atacante podr\u00eda enviar una solicitud URL especialmente manipulada que contenga secuencias de \"puntos\" (/../) para ver archivos arbitrarios en el sistema. ID de IBM X-Force: 239427."
}
],
"id": "CVE-2022-43864",
"lastModified": "2024-11-21T07:27:17.617",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-01-26T21:17:48.697",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/239427"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857223"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857239"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/239427"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857239"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-11-16 17:15
Modified
2024-11-21 05:33
Severity ?
Summary
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/186285 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6367813 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/186285 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6367813 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 20.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versi\u00f3n 20.0.0.1, es vulnerable a un ataque de tipo cross-site scripting.\u0026#xa0;Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 186285"
}
],
"id": "CVE-2020-4672",
"lastModified": "2024-11-21T05:33:06.217",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-11-16T17:15:13.893",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186285"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6367813"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6367813"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-04 01:15
Modified
2024-11-21 08:37
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/275665 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7114419 | Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7114430 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/275665 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7114419 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7114430 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "EA4F72CF-1AE0-4B3B-BD23-4BFB086C843D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "97316AAE-CB3C-4091-8A36-8FBF050E5B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "CEC71A77-3C31-4362-BAF4-A47ED694F73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*",
"matchCriteriaId": "12725407-1B9F-43B7-8D66-F0E3B0181830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*",
"matchCriteriaId": "00F5E82D-712A-4AB2-B0B2-BF03507D17D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*",
"matchCriteriaId": "0063E78F-2978-43F6-884D-B375E1111E87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*",
"matchCriteriaId": "CF6317BE-98DF-4A46-9F5B-326177D6AD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*",
"matchCriteriaId": "72A22C4B-AAF2-4A84-AF39-C1C396031D98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*",
"matchCriteriaId": "39015A02-D36E-4CC9-A5E3-877DFD923ACD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*",
"matchCriteriaId": "19586E74-8802-4C09-A240-D698EE30C570",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*",
"matchCriteriaId": "4B06D109-E327-4A2A-9FC9-A5F454022C0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*",
"matchCriteriaId": "E67BEF93-133E-4507-B938-79D943AB82CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*",
"matchCriteriaId": "84689E35-3C11-44D2-B719-0F47CC7DE6B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*",
"matchCriteriaId": "05248E0A-BE7C-4AA1-80B8-5397382D742E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*",
"matchCriteriaId": "0852419C-62F1-49BA-BD99-96700D33ED64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:containers:*:*:*",
"matchCriteriaId": "628B7F15-103F-4B84-90ED-EBFAD633BCE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:*:*:containers:*:*:*",
"matchCriteriaId": "91E22A7B-18F4-461C-9986-0CECBAB879F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:*:*:containers:*:*:*",
"matchCriteriaId": "4FE832E4-BE4B-4923-A98D-3B127758C103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:*:*:containers:*:*:*",
"matchCriteriaId": "EE7E0724-C7FB-4436-A702-EC2102205175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "4052CAAA-1247-468F-A528-2DAC2F0C745B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "96E5413A-7C63-4066-ADB9-B7A30095D457",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "3E9B8E36-CA86-459C-A0CF-F00F179119FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DFB13BEC-206E-41B3-A4F3-9281EBB0E213",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "827165FB-FCB2-4684-BFC5-D9560BD7FC03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "7EDE5FAA-6843-486D-BEAA-A82E088A2A74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "F7C0BC37-0F42-463F-B2E4-F2B3D3958314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "4283CF30-9B92-4E28-8878-9AF0AAAF24D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "716DF694-558C-4115-B70E-E434602BA933",
"versionEndIncluding": "18.0.2",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00B3BADE-C2D9-40BC-BAD0-39FCA9FC563B",
"versionEndIncluding": "19.0.3",
"versionStartIncluding": "19.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F99EDA35-605B-4AC3-AFFA-F6507F1DD8E5",
"versionEndIncluding": "20.0.3",
"versionStartIncluding": "20.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0413501D-975D-469E-A854-61E12039A8D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:*",
"matchCriteriaId": "5F109F93-1CE8-4F86-9070-73012ED0FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_024:*:*:*:*:*:*",
"matchCriteriaId": "6CC66606-EE8D-4273-832A-4A0391B5DBAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_025:*:*:*:*:*:*",
"matchCriteriaId": "8CEF57DE-61D6-41E6-8C34-06A1F859F9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_026:*:*:*:*:*:*",
"matchCriteriaId": "7C441A0C-5FE4-4F7A-8E88-85E198790D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_028:*:*:*:*:*:*",
"matchCriteriaId": "9A6F6F2E-0ED8-4478-BFC5-92C736323A63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C35A26E3-D2F7-466C-9010-06AA76568A1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "59BF1F79-6E1E-49EE-8D8E-B524F040AA29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "684E6AB2-84C1-4700-B519-88D0C7D8D3CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "78EB3854-3AE9-4AD1-A511-21F02270DB4A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1 y 23.0.2 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 275665."
}
],
"id": "CVE-2023-50947",
"lastModified": "2024-11-21T08:37:35.167",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-04T01:15:25.040",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-09-25 17:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/182715 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6336935 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/182715 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6336935 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 19.0.0.0 | |
| ibm | business_automation_workflow | 20.0.0.0 | |
| ibm | business_process_manager | 8.0.0.0 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "830D598E-6916-4170-946D-C04411077148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "161542A0-E919-4105-AD4F-C881ACF8D26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versiones 8.0, 8.5 y 8.6, podr\u00edan permitir a un atacante remoto obtener informaci\u00f3n confidencial cuando es devuelto un mensaje de error t\u00e9cnico detallado en el navegador.\u0026#xa0;Esta informaci\u00f3n podr\u00eda ser usada en nuevos ataques contra el sistema.\u0026#xa0;IBM X-Force ID: 182715"
}
],
"id": "CVE-2020-4531",
"lastModified": "2024-11-21T05:32:51.437",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-25T17:15:13.847",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182715"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6336935"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182715"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6336935"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-252"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-07 17:15
Modified
2024-11-21 07:23
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 65687.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/237809 | Broken Link, VDB Entry | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6845496 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/237809 | Broken Link, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6845496 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:-:*:*:containers:*:*:*",
"matchCriteriaId": "824ACC07-E351-437A-9FAB-7F2E47DE9205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:-:*:*:containers:*:*:*",
"matchCriteriaId": "485FFABA-EF59-4C36-8B6E-E32A99C02381",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:-:*:*:containers:*:*:*",
"matchCriteriaId": "EB656C4F-19FC-4763-93C8-940A2B38B729",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D1DC801A-0F25-48D2-8465-31B5A0939EE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*",
"matchCriteriaId": "00F5E82D-712A-4AB2-B0B2-BF03507D17D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*",
"matchCriteriaId": "0063E78F-2978-43F6-884D-B375E1111E87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*",
"matchCriteriaId": "CF6317BE-98DF-4A46-9F5B-326177D6AD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*",
"matchCriteriaId": "72A22C4B-AAF2-4A84-AF39-C1C396031D98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*",
"matchCriteriaId": "39015A02-D36E-4CC9-A5E3-877DFD923ACD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*",
"matchCriteriaId": "19586E74-8802-4C09-A240-D698EE30C570",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*",
"matchCriteriaId": "4B06D109-E327-4A2A-9FC9-A5F454022C0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*",
"matchCriteriaId": "E67BEF93-133E-4507-B938-79D943AB82CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*",
"matchCriteriaId": "84689E35-3C11-44D2-B719-0F47CC7DE6B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*",
"matchCriteriaId": "05248E0A-BE7C-4AA1-80B8-5397382D742E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*",
"matchCriteriaId": "0852419C-62F1-49BA-BD99-96700D33ED64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:-:*:*:containers:*:*:*",
"matchCriteriaId": "69B77521-AF61-4711-9219-12D6DADB6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if001:*:*:containers:*:*:*",
"matchCriteriaId": "E2AEA4BA-C309-4069-9226-B86C1B68F93C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if002:*:*:containers:*:*:*",
"matchCriteriaId": "FAE034D0-E532-41DF-B0FE-ED7FB3F67095",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if003:*:*:containers:*:*:*",
"matchCriteriaId": "7DEA8B98-302A-4A88-BF8C-70AFE7E096B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:if004:*:*:containers:*:*:*",
"matchCriteriaId": "2D07B68E-72AE-4616-ADFC-5ABF61EBBC79",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 65687."
},
{
"lang": "es",
"value": "IBM Business Process Manager 21.0.1 a 21.0.3.1, 20.0.0.1 a 20.0.0.2 19.0.0.1 a 19.0.0.3 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 65687."
}
],
"id": "CVE-2022-41735",
"lastModified": "2024-11-21T07:23:45.580",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-07T17:15:10.500",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Broken Link",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/237809"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6845496"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/237809"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6845496"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 12:15
Modified
2024-09-29 00:24
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Summary
IBM Business Automation Workflow
22.0.2, 23.0.1, 23.0.2, and 24.0.0
could allow a privileged user to perform unauthorized activities due to improper client side validation.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7168769 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 22.0.1 | |
| ibm | business_automation_workflow | 22.0.2 | |
| ibm | business_automation_workflow | 23.0.1 | |
| ibm | business_automation_workflow | 23.0.2 | |
| ibm | business_automation_workflow | 24.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "F74D99AD-0570-49B3-9B0D-6F28FA9564B4",
"versionEndIncluding": "18.0.0.3",
"versionStartIncluding": "18.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DFB13BEC-206E-41B3-A4F3-9281EBB0E213",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "F7C0BC37-0F42-463F-B2E4-F2B3D3958314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "7E9F20F6-4D3B-4AD6-9F6B-E145598FFEE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:traditional:*:*:*",
"matchCriteriaId": "95CE7462-D6B6-41AE-BD90-E2D65E0318A3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow \n\n22.0.2, 23.0.1, 23.0.2, and 24.0.0\n\ncould allow a privileged user to perform unauthorized activities due to improper client side validation."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2 y 24.0.0 podr\u00edan permitir que un usuario privilegiado realice actividades no autorizadas debido a una validaci\u00f3n incorrecta del lado del cliente."
}
],
"id": "CVE-2024-43188",
"lastModified": "2024-09-29T00:24:49.103",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T12:15:02.867",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7168769"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-602"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-09-08 15:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/182371 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6326901 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/182371 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6326901 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90104525-6A11-4A42-8DD8-BFE267FCF306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*",
"matchCriteriaId": "8578A0D7-3330-4F79-A934-4940673383A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "CC44A2D4-F3D3-4D98-8FDC-8274E1725800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:express:*:*:*",
"matchCriteriaId": "C28E7D30-82E5-4E46-8F4E-C4C11641D40C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:standard:*:*:*",
"matchCriteriaId": "9B7F2C25-331F-4733-92BD-7DC02B3378EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:express:*:*:*",
"matchCriteriaId": "28D39434-BC55-40CC-B02C-68C272C67013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "570E9DFF-F991-4D14-87F4-F7FE9554E58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*",
"matchCriteriaId": "ADE7414F-BF17-4415-95C3-FDBC2BC5C7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "E590C058-EC80-48FB-87C7-3F84E2BC07E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8736CAA3-7C69-4F8D-936B-2B7B3B5DEED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "CD9103EF-29E7-48E6-ADF4-66D74C3FF427",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:express:*:*:*",
"matchCriteriaId": "54C2CBF0-838B-4F7F-9E63-25053EC6D2E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:standard:*:*:*",
"matchCriteriaId": "A30BF550-893B-4F5D-B128-157655B6F8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:express:*:*:*",
"matchCriteriaId": "0D6B3497-1C02-43C0-8B73-9289F7FC00A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:standard:*:*:*",
"matchCriteriaId": "82E8F8FF-7C1E-4684-B479-BB3F8EA13B80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:express:*:*:*",
"matchCriteriaId": "7B136A70-552E-4545-853A-BAFD0919D52C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:standard:*:*:*",
"matchCriteriaId": "25AFA35A-B7BC-430C-8AF9-73653E6D36B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:express:*:*:*",
"matchCriteriaId": "94F5B156-9994-4A1A-A552-FA4108908883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:standard:*:*:*",
"matchCriteriaId": "6E9348B4-025E-4A86-A3B5-616840F28B58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:express:*:*:*",
"matchCriteriaId": "BD42A0F7-540B-4673-AD8C-373A424A27B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:standard:*:*:*",
"matchCriteriaId": "1B8D6782-F9D8-4B89-8C1D-9BB8992BD89F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:express:*:*:*",
"matchCriteriaId": "10DBD799-4712-42F1-8B03-88DAE9A685F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:standard:*:*:*",
"matchCriteriaId": "930CE10A-D6B0-423E-9450-AEDBF0A1E503",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371."
},
{
"lang": "es",
"value": "IBM Business Process Manager versiones 8.5, 8.6 e IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0, son vulnerables a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 182371."
}
],
"id": "CVE-2020-4516",
"lastModified": "2024-11-21T05:32:50.090",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-08T15:15:12.037",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182371"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6326901"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182371"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6326901"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-20 19:15
Modified
2024-11-21 04:43
Severity ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/162771 | Broken Link, VDB Entry | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10959261 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/162771 | Broken Link, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10959261 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4BD15E1F-A2A1-4B07-9597-8FC9A3E47863",
"versionEndIncluding": "19.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf01:*:*:*:*:*:*",
"matchCriteriaId": "038632B3-66AF-4F11-9834-BEDF269AB235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf02:*:*:*:*:*:*",
"matchCriteriaId": "30D2B29A-C262-4006-B004-085DA319AFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.06:*:*:*:*:*:*",
"matchCriteriaId": "51A3D3D0-45DE-4B42-8766-181793090845",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.09:*:*:*:*:*:*",
"matchCriteriaId": "BE3CB0E7-437F-4EFB-94AE-9325D2CC6005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.12:*:*:*:*:*:*",
"matchCriteriaId": "79A27F7F-9EAE-4E2B-B5E8-2C82380D9C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.03:*:*:*:*:*:*",
"matchCriteriaId": "3F268A9C-9E13-4573-A75E-308CA3193836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
"matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "6DE7BCD3-C969-4248-B325-8EAAE9959797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2017.12:*:*:-:*:*:*",
"matchCriteriaId": "82A2B33F-5E31-410A-BBE8-B400F928CC16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:-:*:*:*",
"matchCriteriaId": "2D312C42-2CB3-499A-8A74-997155811C6A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1 y 18.0.0.2 podr\u00eda permitir a un usuario obtener informaci\u00f3n altamente confidencial de otro usuario insertando enlaces en los que los usuarios desprevenidos har\u00edan clic. ID de IBM X-Force: 162771."
}
],
"id": "CVE-2019-4425",
"lastModified": "2024-11-21T04:43:35.463",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.1,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-20T19:15:12.137",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Broken Link",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162771"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959261"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162771"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10959261"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-09-05 15:15
Modified
2024-11-21 04:43
Severity ?
Summary
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/158415 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10885104 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/158415 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10885104 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8A1C8F-793A-4F66-8217-70E16C5C832B",
"versionEndIncluding": "18.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*",
"matchCriteriaId": "D2B1150A-E780-42BF-8D9E-77258C1D869A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "04D332A0-BEA8-4E22-A37C-1AC76B36ACDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201712:*:*:*:*:*:*",
"matchCriteriaId": "F7B13D9D-E6BC-4621-A3F2-57F501DC97B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*",
"matchCriteriaId": "71A849EF-53B1-4402-85BE-D75E4765AEAB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versi\u00f3n 18.0.0.0 hasta la versi\u00f3n 18.0.0.2 e IBM Business Process Manager versi\u00f3n 8.6.0.0 hasta la versi\u00f3n 8.6.0.0 Cumulative Fix 2018.03, versi\u00f3n 8.5.7.0 hasta la versi\u00f3n 8.5.7.0 Cumulative Fix 2017.06, y versi\u00f3n 8.5.6.0 hasta la versi\u00f3n 8.5.6.0 CF2 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista que puede conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza. ID de IBM X-Force: 158415."
}
],
"id": "CVE-2019-4149",
"lastModified": "2024-11-21T04:43:14.430",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-09-05T15:15:12.907",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158415"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10885104"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158415"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10885104"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-12-21 18:15
Modified
2024-11-21 05:33
Severity ?
Summary
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/189445 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6359463 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/189445 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6359463 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:automation_workstream_services:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CC485727-BCA4-4795-B292-1FB1BCFEFC4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:automation_workstream_services:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7FAFF81-3E55-4E8A-AD77-4CF8092862B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:automation_workstream_services:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F993AA19-B127-4839-BDE6-654FBB95A2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "FE68791B-B7AE-4715-810E-0C278E5C363F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "37281A0A-3BE1-4B22-840F-65CA7B8AB360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "00CC8270-5ABE-428C-9090-16EC8298E50C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "446C4FEE-DDB7-41C5-BC9B-7E6B08B074BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "A05F59A1-3063-45ED-B1E8-AABC4FC0A807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "3FC25EB0-CA22-4176-8752-8BD26B111F2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "60F679C8-74FB-40F5-A5B8-FBD6BF424379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "7C097D2E-5BB7-4979-A755-E928094A92C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*",
"matchCriteriaId": "0DDE4CB3-1162-4A51-8EBA-2A25E8B6898B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*",
"matchCriteriaId": "021FABA7-6B97-4511-8E07-B7A34A387493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*",
"matchCriteriaId": "8578A0D7-3330-4F79-A934-4940673383A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "CC44A2D4-F3D3-4D98-8FDC-8274E1725800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:express:*:*:*",
"matchCriteriaId": "C28E7D30-82E5-4E46-8F4E-C4C11641D40C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:standard:*:*:*",
"matchCriteriaId": "9B7F2C25-331F-4733-92BD-7DC02B3378EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:express:*:*:*",
"matchCriteriaId": "28D39434-BC55-40CC-B02C-68C272C67013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "570E9DFF-F991-4D14-87F4-F7FE9554E58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*",
"matchCriteriaId": "ADE7414F-BF17-4415-95C3-FDBC2BC5C7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "E590C058-EC80-48FB-87C7-3F84E2BC07E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8736CAA3-7C69-4F8D-936B-2B7B3B5DEED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "CD9103EF-29E7-48E6-ADF4-66D74C3FF427",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:express:*:*:*",
"matchCriteriaId": "54C2CBF0-838B-4F7F-9E63-25053EC6D2E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:standard:*:*:*",
"matchCriteriaId": "A30BF550-893B-4F5D-B128-157655B6F8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:express:*:*:*",
"matchCriteriaId": "0D6B3497-1C02-43C0-8B73-9289F7FC00A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:standard:*:*:*",
"matchCriteriaId": "82E8F8FF-7C1E-4684-B479-BB3F8EA13B80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:express:*:*:*",
"matchCriteriaId": "7B136A70-552E-4545-853A-BAFD0919D52C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:standard:*:*:*",
"matchCriteriaId": "25AFA35A-B7BC-430C-8AF9-73653E6D36B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:express:*:*:*",
"matchCriteriaId": "94F5B156-9994-4A1A-A552-FA4108908883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:standard:*:*:*",
"matchCriteriaId": "6E9348B4-025E-4A86-A3B5-616840F28B58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:express:*:*:*",
"matchCriteriaId": "BD42A0F7-540B-4673-AD8C-373A424A27B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:standard:*:*:*",
"matchCriteriaId": "1B8D6782-F9D8-4B89-8C1D-9BB8992BD89F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:express:*:*:*",
"matchCriteriaId": "24092BD2-EB46-4A8C-8349-2B440136A63F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:standard:*:*:*",
"matchCriteriaId": "D56F51A2-70AE-42C5-8B11-72E75F182F62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "F6ED3777-F79B-4A0E-8E25-6721C61B54F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "23520189-E725-45B1-8C21-4D7ECF32CA6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "329D772E-2E9B-408E-99C8-D80E44BAD5B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "535AE550-01A0-447C-8894-64A93C63047C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "B951DC34-8E68-4B61-8C6A-347F0D1ECC97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "38A0A6F6-0115-4ADD-B427-E9466CE62E06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:-:*:*:*",
"matchCriteriaId": "416DE921-452B-41ED-9A34-070CFD4961EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.0:*:*:*:docker:*:*:*",
"matchCriteriaId": "27B06738-6C46-4C69-827C-6BC6A657B3AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "EA4F72CF-1AE0-4B3B-BD23-4BFB086C843D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.2.0:*:*:*:-:*:*:*",
"matchCriteriaId": "10BD116F-33BC-47F8-906D-F6AD5206439B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445."
},
{
"lang": "es",
"value": "IBM Automation Workstream Services versiones 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versi\u00f3n 8.6, podr\u00edan permitir a un usuario autenticado conseguir informaci\u00f3n confidencial o causar una denegaci\u00f3n de servicio debido a una comprobaci\u00f3n inapropiada de autorizaci\u00f3n.\u0026#xa0;IBM X-Force ID: 189445"
}
],
"id": "CVE-2020-4794",
"lastModified": "2024-11-21T05:33:16.023",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-12-21T18:15:16.040",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/189445"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6359463"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/189445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6359463"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-06 14:15
Modified
2024-11-21 05:32
Severity ?
Summary
IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/181126 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6205805 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/181126 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6205805 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8A1C8F-793A-4F66-8217-70E16C5C832B",
"versionEndIncluding": "18.0.0.2",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01362A8C-8482-4AEA-AF8C-62642B6BAD89",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56662DF9-BE20-4B67-A391-889F9EB3F0AC",
"versionEndIncluding": "8.5.7.0",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126."
},
{
"lang": "es",
"value": "IBM Business Process Manager versiones 8.0, 8.5 y 8.6 e IBM Business Automation Workflow versiones 18.0 y 19.0, podr\u00edan permitir a un atacante remoto omitir las restricciones de seguridad, causadas mediante el fallo al realizar comprobaciones de autorizaci\u00f3n insuficientes. ID de IBM X-Force: 181126."
}
],
"id": "CVE-2020-4446",
"lastModified": "2024-11-21T05:32:44.867",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-06T14:15:11.020",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181126"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6205805"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181126"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6205805"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-05-06 03:15
Modified
2024-11-21 07:48
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/246115 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6965776 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/246115 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6965776 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01362A8C-8482-4AEA-AF8C-62642B6BAD89",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:containers:*:*:*",
"matchCriteriaId": "D2E08C00-5E88-4A99-BC1C-04717E6F458A",
"versionEndExcluding": "21.0.3",
"versionStartIncluding": "20.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:containers:*:*:*",
"matchCriteriaId": "C2916CA1-8020-46D6-B114-E63066EB6972",
"versionEndExcluding": "22.0.2",
"versionStartIncluding": "22.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:-:*:*:*",
"matchCriteriaId": "F6ED3777-F79B-4A0E-8E25-6721C61B54F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "23520189-E725-45B1-8C21-4D7ECF32CA6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "329D772E-2E9B-408E-99C8-D80E44BAD5B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*",
"matchCriteriaId": "12725407-1B9F-43B7-8D66-F0E3B0181830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*",
"matchCriteriaId": "00F5E82D-712A-4AB2-B0B2-BF03507D17D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*",
"matchCriteriaId": "0063E78F-2978-43F6-884D-B375E1111E87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*",
"matchCriteriaId": "CF6317BE-98DF-4A46-9F5B-326177D6AD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*",
"matchCriteriaId": "72A22C4B-AAF2-4A84-AF39-C1C396031D98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*",
"matchCriteriaId": "39015A02-D36E-4CC9-A5E3-877DFD923ACD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*",
"matchCriteriaId": "19586E74-8802-4C09-A240-D698EE30C570",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*",
"matchCriteriaId": "4B06D109-E327-4A2A-9FC9-A5F454022C0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*",
"matchCriteriaId": "E67BEF93-133E-4507-B938-79D943AB82CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*",
"matchCriteriaId": "84689E35-3C11-44D2-B719-0F47CC7DE6B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*",
"matchCriteriaId": "05248E0A-BE7C-4AA1-80B8-5397382D742E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*",
"matchCriteriaId": "0852419C-62F1-49BA-BD99-96700D33ED64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:containers:*:*:*",
"matchCriteriaId": "628B7F15-103F-4B84-90ED-EBFAD633BCE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:*:*:containers:*:*:*",
"matchCriteriaId": "91E22A7B-18F4-461C-9986-0CECBAB879F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:*:*:containers:*:*:*",
"matchCriteriaId": "4FE832E4-BE4B-4923-A98D-3B127758C103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DFB13BEC-206E-41B3-A4F3-9281EBB0E213",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:-:*:*:containers:*:*:*",
"matchCriteriaId": "AD4D26F8-D9BD-45F9-95FA-5B02587672FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:if001:*:*:containers:*:*:*",
"matchCriteriaId": "EDE24FAD-9C9E-41EB-8895-7CDB7A31F260",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115."
}
],
"id": "CVE-2023-24957",
"lastModified": "2024-11-21T07:48:50.620",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-05-06T03:15:09.027",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/246115"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6965776"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/246115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6965776"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-05-31 16:15
Modified
2024-11-21 06:46
Severity ?
Summary
IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/220784 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6590411 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/220784 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6590411 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | * | |
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01362A8C-8482-4AEA-AF8C-62642B6BAD89",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "067C1CD5-4763-4404-86E2-C17520B81ECC",
"versionEndIncluding": "21.0.3",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "752B82E1-C25A-4BAE-A4CB-9A8728A6B2A4",
"versionEndIncluding": "8.5.0.201706",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D3DCB5C-38AC-4BF5-8608-53FD1008291F",
"versionEndIncluding": "8.6.0.201803",
"versionStartIncluding": "8.6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow tradicional versiones 21.0.1 hasta 21.0.3, 20.0.0.1 hasta 20.0.0.2, 19.0.0.1 hasta 19.0.0.3, 18.0.0.0 hasta 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 hasta 20.0.0. 2, IBM Business Process Manager 8.6.0.0 hasta 8.6.0.201803, y 8.5.0.0 hasta 8.5.0.201706 es vulnerable a la falsificaci\u00f3n de petici\u00f3n de sitio cruzado que podr\u00eda permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario en el que el sitio web conf\u00eda"
}
],
"id": "CVE-2022-22361",
"lastModified": "2024-11-21T06:46:42.090",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-31T16:15:07.957",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6590411"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6590411"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-29 16:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/204832 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6493271 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/204832 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6493271 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_automation_workflow | 18.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.1 | |
| ibm | business_automation_workflow | 19.0.0.2 | |
| ibm | business_automation_workflow | 19.0.0.3 | |
| ibm | business_automation_workflow | 20.0.0.1 | |
| ibm | business_automation_workflow | 20.0.0.2 | |
| ibm | business_automation_workflow | 21.0.2 | |
| ibm | business_process_manager | 8.5.0.0 | |
| ibm | business_process_manager | 8.6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "068CE38A-FBC4-43BF-BD1D-F65F9ADC5141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow versiones 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2 y 21.0.2 e IBM Business Process Manager 8.5 y 8.6 son vulnerables a un ataque de tipo cross-site scripting almacenado. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario web, alterando as\u00ed la funcionalidad prevista y conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 204832"
}
],
"id": "CVE-2021-29834",
"lastModified": "2024-11-21T06:01:53.443",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-29T16:15:07.867",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204832"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6493271"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/204832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6493271"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}