Vulnerability-Lookup

CVE-2018-1997 (GCVE-0-2018-1997)

Vulnerability from cvelistv5 – Published: 2019-04-08 14:50 – Updated: 2024-09-16 23:52

Summary

IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/A:L/PR:L/I:N/AC:L/C:N/S:U/UI:N/AV:N/RL:O/E:U/RC:C

CWE

Denial of Service

Assigner

ibm CNA under the mitre root

CNA scorecard B 88/100 over 1289 records in the last 180 days details

References

2 references

URL	Tags
https://www.ibm.com/support/docview.wss?uid=ibm10794831	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF

Impacted products

1 product

Vendor	Product	Version	CPE status
IBM	Business Automation Workflow	Affected: 18.0.0.0 Affected: 18.0.0.1 Affected: 18.0.0.2	guessed

Date Public

2019-04-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:14:39.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
          },
          {
            "name": "ibm-baw-cve20181997-dos (154774)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Business Automation Workflow",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.0.0"
            },
            {
              "status": "affected",
              "version": "18.0.0.1"
            },
            {
              "status": "affected",
              "version": "18.0.0.2"
            }
          ]
        }
      ],
      "datePublic": "2019-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 3.8,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/A:L/PR:L/I:N/AC:L/C:N/S:U/UI:N/AV:N/RL:O/E:U/RC:C",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-08T14:50:37.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
        },
        {
          "name": "ibm-baw-cve20181997-dos (154774)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2019-04-04T00:00:00",
          "ID": "CVE-2018-1997",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Business Automation Workflow",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "18.0.0.0"
                          },
                          {
                            "version_value": "18.0.0.1"
                          },
                          {
                            "version_value": "18.0.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "L",
              "AC": "L",
              "AV": "N",
              "C": "N",
              "I": "N",
              "PR": "L",
              "S": "U",
              "UI": "N"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/docview.wss?uid=ibm10794831",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 794831 (Business Automation Workflow)",
              "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
            },
            {
              "name": "ibm-baw-cve20181997-dos (154774)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2018-1997",
    "datePublished": "2019-04-08T14:50:37.952Z",
    "dateReserved": "2017-12-13T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:52:15.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-1997",
      "date": "2026-10-25",
      "epss": "0.01358",
      "percentile": "0.71472"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
                  "matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
                  "matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
                  "matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
                  "matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
        },
        {
          "lang": "es",
          "value": "Business Automation Workflow y Business Process Manager de IBM en las versiones 18.0.0.0, 18.0.0.1 y 18.0.0.2 son vulnerables a un ataque de denegaci\u00f3n de servicio. Un atacante autenticado puede enviar una petici\u00f3n especialmente creada que agote la memoria del lado del servidor. ID de IBM X-Force: 154774."
        }
      ],
      "id": "CVE-2018-1997",
      "lastModified": "2024-11-21T04:00:43.103",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 4.0,
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.0"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 1.4,
            "source": "psirt@us.ibm.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.0"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2019-04-08T15:29:00.873",
      "references": [
        {
          "source": "psirt@us.ibm.com",
          "tags": [
            "VDB Entry",
            "Vendor Advisory"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
        },
        {
          "source": "psirt@us.ibm.com",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "VDB Entry",
            "Vendor Advisory"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
        }
      ],
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
                    "matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
                    "matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
                    "matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
                    "matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
          },
          {
            "lang": "es",
            "value": "Business Automation Workflow y Business Process Manager de IBM en las versiones 18.0.0.0, 18.0.0.1 y 18.0.0.2 son vulnerables a un ataque de denegaci\u00f3n de servicio. Un atacante autenticado puede enviar una petici\u00f3n especialmente creada que agote la memoria del lado del servidor. ID de IBM X-Force: 154774."
          }
        ],
        "id": "CVE-2018-1997",
        "lastModified": "2024-11-21T04:00:43.103",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.0"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "psirt@us.ibm.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2019-04-08T15:29:00.873",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "VDB Entry",
              "Vendor Advisory"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
          },
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "VDB Entry",
              "Vendor Advisory"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CNVD-2020-19866

Vulnerability from cnvd - Published: 2020-03-28

Title

IBM Business Process Manager和IBM Business Automation Workflow拒绝服务漏洞

Description

IBM Business Process Manager（BPM）和IBM Business Automation Workflow都是美国IBM公司的产品。IBM Business Process Manager是一套综合的业务流程管理平台。该平台为业务的流程建模、组装、监控和部署提供了一系列的相关工具。IBM Business Automation Workflow是一套工作流程自动化解决方案。该产品主要用于工作流程管理、合规性管理，并具有工作流程可见性和可扩展等特点。 IBM Business Automation Workflow和BPM中存在安全漏洞。该漏洞源于网络系统或产品对系统资源（如内存、磁盘空间、文件等）的管理不当。攻击者可能会在通过身份认证后利用该漏洞发送一个耗尽服务器端内存的特制请求，导致拒绝服务。

Severity

中

Patch Name

IBM Business Process Manager和IBM Business Automation Workflow拒绝服务漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www-01.ibm.com/support/docview.wss?uid=ibm10794831

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-1997

Impacted products

Name
['IBM Business Process Manager 8.5.5.0', 'IBM Business Process Manager 8.6.0.0', 'IBM Business Process Manager 8.5.7.0', 'IBM Business Automation Workflow 18.0.0.0', 'IBM Business Automation Workflow 18.0.0.1', 'IBM Business Automation Workflow 18.0.0.2', 'IBM Business Process Manager 8.5 1', 'IBM Business Process Manager 8.5.0.0', 'IBM Business Process Manager 8.5.0.2', 'IBM Business Process Manager 8.5.6.0', 'IBM Business Process Manager 8.5.6.0 CF 2', 'IBM Business Process Manager 8.5.7.0 CF 2016.12', 'IBM Business Process Manager 8.5.7.0 CF 2017.03', 'IBM Business Process Manager 8.5.7.0 CF 2017.06', 'IBM Business Process Manager 8.6.0.0 CF 2018.03']

Name

['IBM Business Process Manager 8.5.5.0', 'IBM Business Process Manager 8.6.0.0', 'IBM Business Process Manager 8.5.7.0', 'IBM Business Automation Workflow 18.0.0.0', 'IBM Business Automation Workflow 18.0.0.1', 'IBM Business Automation Workflow 18.0.0.2', 'IBM Business Process Manager 8.5 1', 'IBM Business Process Manager 8.5.0.0', 'IBM Business Process Manager 8.5.0.2', 'IBM Business Process Manager 8.5.6.0', 'IBM Business Process Manager 8.5.6.0 CF 2', 'IBM Business Process Manager 8.5.7.0 CF 2016.12', 'IBM Business Process Manager 8.5.7.0 CF 2017.03', 'IBM Business Process Manager 8.5.7.0 CF 2017.06', 'IBM Business Process Manager 8.6.0.0 CF 2018.03']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "108513"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1997",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2018-1997"
    }
  },
  "description": "IBM Business Process Manager\uff08BPM\uff09\u548cIBM Business Automation Workflow\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM Business Process Manager\u662f\u4e00\u5957\u7efc\u5408\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3a\u4e1a\u52a1\u7684\u6d41\u7a0b\u5efa\u6a21\u3001\u7ec4\u88c5\u3001\u76d1\u63a7\u548c\u90e8\u7f72\u63d0\u4f9b\u4e86\u4e00\u7cfb\u5217\u7684\u76f8\u5173\u5de5\u5177\u3002IBM Business Automation Workflow\u662f\u4e00\u5957\u5de5\u4f5c\u6d41\u7a0b\u81ea\u52a8\u5316\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u7528\u4e8e\u5de5\u4f5c\u6d41\u7a0b\u7ba1\u7406\u3001\u5408\u89c4\u6027\u7ba1\u7406\uff0c\u5e76\u5177\u6709\u5de5\u4f5c\u6d41\u7a0b\u53ef\u89c1\u6027\u548c\u53ef\u6269\u5c55\u7b49\u7279\u70b9\u3002\n\nIBM Business Automation Workflow\u548cBPM\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u5bf9\u7cfb\u7edf\u8d44\u6e90\uff08\u5982\u5185\u5b58\u3001\u78c1\u76d8\u7a7a\u95f4\u3001\u6587\u4ef6\u7b49\uff09\u7684\u7ba1\u7406\u4e0d\u5f53\u3002\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u5728\u901a\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u540e\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u9001\u4e00\u4e2a\u8017\u5c3d\u670d\u52a1\u5668\u7aef\u5185\u5b58\u7684\u7279\u5236\u8bf7\u6c42\uff0c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www-01.ibm.com/support/docview.wss?uid=ibm10794831",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-19866",
  "openTime": "2020-03-28",
  "patchDescription": "IBM Business Process Manager\uff08BPM\uff09\u548cIBM Business Automation Workflow\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM Business Process Manager\u662f\u4e00\u5957\u7efc\u5408\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3a\u4e1a\u52a1\u7684\u6d41\u7a0b\u5efa\u6a21\u3001\u7ec4\u88c5\u3001\u76d1\u63a7\u548c\u90e8\u7f72\u63d0\u4f9b\u4e86\u4e00\u7cfb\u5217\u7684\u76f8\u5173\u5de5\u5177\u3002IBM Business Automation Workflow\u662f\u4e00\u5957\u5de5\u4f5c\u6d41\u7a0b\u81ea\u52a8\u5316\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u7528\u4e8e\u5de5\u4f5c\u6d41\u7a0b\u7ba1\u7406\u3001\u5408\u89c4\u6027\u7ba1\u7406\uff0c\u5e76\u5177\u6709\u5de5\u4f5c\u6d41\u7a0b\u53ef\u89c1\u6027\u548c\u53ef\u6269\u5c55\u7b49\u7279\u70b9\u3002\r\n\r\nIBM Business Automation Workflow\u548cBPM\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u5bf9\u7cfb\u7edf\u8d44\u6e90\uff08\u5982\u5185\u5b58\u3001\u78c1\u76d8\u7a7a\u95f4\u3001\u6587\u4ef6\u7b49\uff09\u7684\u7ba1\u7406\u4e0d\u5f53\u3002\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u5728\u901a\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u540e\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u9001\u4e00\u4e2a\u8017\u5c3d\u670d\u52a1\u5668\u7aef\u5185\u5b58\u7684\u7279\u5236\u8bf7\u6c42\uff0c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Business Process Manager\u548cIBM Business Automation Workflow\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Business Process Manager 8.5.5.0",
      "IBM Business Process Manager 8.6.0.0",
      "IBM Business Process Manager 8.5.7.0",
      "IBM Business Automation Workflow 18.0.0.0",
      "IBM Business Automation Workflow 18.0.0.1",
      "IBM Business Automation Workflow 18.0.0.2",
      "IBM Business Process Manager 8.5 1",
      "IBM Business Process Manager 8.5.0.0",
      "IBM Business Process Manager 8.5.0.2",
      "IBM Business Process Manager 8.5.6.0",
      "IBM Business Process Manager 8.5.6.0 CF 2",
      "IBM Business Process Manager 8.5.7.0 CF 2016.12",
      "IBM Business Process Manager 8.5.7.0 CF 2017.03",
      "IBM Business Process Manager 8.5.7.0 CF 2017.06",
      "IBM Business Process Manager 8.6.0.0 CF 2018.03"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-1997",
  "serverity": "\u4e2d",
  "submitTime": "2019-07-05",
  "title": "IBM Business Process Manager\u548cIBM Business Automation Workflow\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

FKIE_CVE-2018-1997

Vulnerability from fkie_nvd - Published: 2019-04-08 15:29 - Updated: 2026-06-17 01:52

Severity

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/154774	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/docview.wss?uid=ibm10794831	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/154774	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/docview.wss?uid=ibm10794831	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	business_automation_workflow	18.0.0.0
ibm	business_automation_workflow	18.0.0.1
ibm	business_automation_workflow	18.0.0.2
ibm	business_process_manager	8.5.5.0
ibm	business_process_manager	8.5.6.0
ibm	business_process_manager	8.5.6.0
ibm	business_process_manager	8.5.6.0
ibm	business_process_manager	8.5.7.0
ibm	business_process_manager	8.5.7.0
ibm	business_process_manager	8.6.0.0
ibm	business_process_manager	8.6.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Business Automation Workflow",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.0.0"
            },
            {
              "status": "affected",
              "version": "18.0.0.1"
            },
            {
              "status": "affected",
              "version": "18.0.0.2"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
              "matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
              "matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
              "matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
              "matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
    },
    {
      "lang": "es",
      "value": "Business Automation Workflow y Business Process Manager de IBM en las versiones 18.0.0.0, 18.0.0.1 y 18.0.0.2 son vulnerables a un ataque de denegaci\u00f3n de servicio. Un atacante autenticado puede enviar una petici\u00f3n especialmente creada que agote la memoria del lado del servidor. ID de IBM X-Force: 154774."
    }
  ],
  "id": "CVE-2018-1997",
  "lastModified": "2026-06-17T01:52:08.210",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-04-08T15:29:00.873",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-XCGX-F24F-JJ4R

Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-1997"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-08T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.",
  "id": "GHSA-xcgx-f24f-jj4r",
  "modified": "2022-05-13T01:32:25Z",
  "published": "2022-05-13T01:32:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1997"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2018-1997

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2018-1997

Aliases

CVE-2018-1997

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-1997",
    "description": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.",
    "id": "GSD-2018-1997"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-1997"
      ],
      "details": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.",
      "id": "GSD-2018-1997",
      "modified": "2023-12-13T01:22:37.267546Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@us.ibm.com",
        "DATE_PUBLIC": "2019-04-04T00:00:00",
        "ID": "CVE-2018-1997",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Business Automation Workflow",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "18.0.0.0"
                        },
                        {
                          "version_value": "18.0.0.1"
                        },
                        {
                          "version_value": "18.0.0.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IBM"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
          }
        ]
      },
      "impact": {
        "cvssv3": {
          "BM": {
            "A": "L",
            "AC": "L",
            "AV": "N",
            "C": "N",
            "I": "N",
            "PR": "L",
            "S": "U",
            "SCORE": "4.300",
            "UI": "N"
          },
          "TM": {
            "E": "U",
            "RC": "C",
            "RL": "O"
          }
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Denial of Service"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.ibm.com/support/docview.wss?uid=ibm10794831",
            "refsource": "CONFIRM",
            "title": "IBM Security Bulletin 794831 (Business Automation Workflow)",
            "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
          },
          {
            "name": "ibm-baw-cve20181997-dos (154774)",
            "refsource": "XF",
            "title": "X-Force Vulnerability Report",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2018-1997"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/docview.wss?uid=ibm10794831",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.ibm.com/support/docview.wss?uid=ibm10794831"
            },
            {
              "name": "ibm-baw-cve20181997-dos (154774)",
              "refsource": "XF",
              "tags": [
                "Vendor Advisory",
                "VDB Entry"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/154774"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2019-10-09T23:39Z",
      "publishedDate": "2019-04-08T15:29Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2018-1997 (GCVE-0-2018-1997)

CNVD-2020-19866

FKIE_CVE-2018-1997

GHSA-XCGX-F24F-JJ4R

GSD-2018-1997

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour