cnvd - cnvd-2022-15537

CNVD-2022-15537

Vulnerability from cnvd - Published: 2022-03-01

Title

IBM Business Automation Workflow跨站脚本漏洞（CNVD-2022-15537）

Description

IBM Business Automation Workflow是美国IBM公司的一套工作流程自动化解决方案。该产品主要用于工作流程管理、合规性管理，并具有工作流程可见性和可扩展等特点。 IBM Business Automation Workflow存在安全漏洞，该漏洞源于IBM业务自动化工作流容易受到存储的跨站点脚本编制的影响。攻击者可利用该漏洞允许用户在Web UI中嵌入任意JavaScript代码，从而改变预期的功能，从而可能导致可信会话中的凭证泄露。

Severity

低

Patch Name

IBM Business Automation Workflow跨站脚本漏洞（CNVD-2022-15537）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://www.ibm.com/support/pages/node/6527782

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-38893

Impacted products

Name
['IBM IBM Business Automation Workflow V21.0', 'IBM IBM Business Automation Workflow V20.0', 'IBM IBM Business Automation Workflow V19.0', 'IBM IBM Business Automation Workflow V18.0', 'IBM IBM Business Process Manager V8.6', 'IBM IBM Business Process Manager V8.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-38893",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-38893"
    }
  },
  "description": "IBM Business Automation Workflow\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5de5\u4f5c\u6d41\u7a0b\u81ea\u52a8\u5316\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u7528\u4e8e\u5de5\u4f5c\u6d41\u7a0b\u7ba1\u7406\u3001\u5408\u89c4\u6027\u7ba1\u7406\uff0c\u5e76\u5177\u6709\u5de5\u4f5c\u6d41\u7a0b\u53ef\u89c1\u6027\u548c\u53ef\u6269\u5c55\u7b49\u7279\u70b9\u3002\n\nIBM Business Automation Workflow\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eIBM\u4e1a\u52a1\u81ea\u52a8\u5316\u5de5\u4f5c\u6d41\u5bb9\u6613\u53d7\u5230\u5b58\u50a8\u7684\u8de8\u7ad9\u70b9\u811a\u672c\u7f16\u5236\u7684\u5f71\u54cd\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5141\u8bb8\u7528\u6237\u5728Web UI\u4e2d\u5d4c\u5165\u4efb\u610fJavaScript\u4ee3\u7801\uff0c\u4ece\u800c\u6539\u53d8\u9884\u671f\u7684\u529f\u80fd\uff0c\u4ece\u800c\u53ef\u80fd\u5bfc\u81f4\u53ef\u4fe1\u4f1a\u8bdd\u4e2d\u7684\u51ed\u8bc1\u6cc4\u9732\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.ibm.com/support/pages/node/6527782",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-15537",
  "openTime": "2022-03-01",
  "patchDescription": "IBM Business Automation Workflow\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5de5\u4f5c\u6d41\u7a0b\u81ea\u52a8\u5316\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u7528\u4e8e\u5de5\u4f5c\u6d41\u7a0b\u7ba1\u7406\u3001\u5408\u89c4\u6027\u7ba1\u7406\uff0c\u5e76\u5177\u6709\u5de5\u4f5c\u6d41\u7a0b\u53ef\u89c1\u6027\u548c\u53ef\u6269\u5c55\u7b49\u7279\u70b9\u3002\r\n\r\nIBM Business Automation Workflow\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eIBM\u4e1a\u52a1\u81ea\u52a8\u5316\u5de5\u4f5c\u6d41\u5bb9\u6613\u53d7\u5230\u5b58\u50a8\u7684\u8de8\u7ad9\u70b9\u811a\u672c\u7f16\u5236\u7684\u5f71\u54cd\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5141\u8bb8\u7528\u6237\u5728Web UI\u4e2d\u5d4c\u5165\u4efb\u610fJavaScript\u4ee3\u7801\uff0c\u4ece\u800c\u6539\u53d8\u9884\u671f\u7684\u529f\u80fd\uff0c\u4ece\u800c\u53ef\u80fd\u5bfc\u81f4\u53ef\u4fe1\u4f1a\u8bdd\u4e2d\u7684\u51ed\u8bc1\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Business Automation Workflow\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2022-15537\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM Business Automation Workflow V21.0",
      "IBM IBM Business Automation Workflow V20.0",
      "IBM IBM Business Automation Workflow V19.0",
      "IBM IBM Business Automation Workflow V18.0",
      "IBM IBM Business Process Manager V8.6",
      "IBM IBM Business Process Manager V8.5"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-38893",
  "serverity": "\u4f4e",
  "submitTime": "2021-12-21",
  "title": "IBM Business Automation Workflow\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2022-15537\uff09"
}

CVE-2021-38893 (GCVE-0-2021-38893)

Vulnerability from cvelistv5 – Published: 2021-12-21 19:10 – Updated: 2024-09-17 00:26

Summary

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.0/I:L/PR:L/C:L/S:C/UI:N/AC:L/AV:N/A:N/RC:C/RL:O/E:H

CWE

Cross-Site Scripting

Assigner

ibm

References

URL

Tags

	https://www.ibm.com/support/pages/node/6527782	x_refsource_CONFIRM
	https://www.ibm.com/support/pages/node/6526488	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF

Impacted products

Vendor

Product

Version

IBM

Cloud Pak for Automation

Affected: 21.0.2

IBM

Business Process Manager Standard

Affected: 8.5.5
Affected: 8.5.7.CF201706
Affected: 8.5.7.CF201703
Affected: 8.5.7.CF201612
Affected: 8.5.7.CF201609
Affected: 8.5.7.CF201606
Affected: 8.5.7
Affected: 8.5.6.2
Affected: 8.5.6.1
Affected: 8.5.6
Affected: 8.6
Affected: 8.5.0.2
Affected: 8.5.0.1
Affected: 8.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:20.703Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6527782"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6526488"
          },
          {
            "name": "ibm-baw-cve202138893-xss (209512)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cloud Pak for Automation",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "21.0.2"
            }
          ]
        },
        {
          "product": "Business Process Manager Standard",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.5.5"
            },
            {
              "status": "affected",
              "version": "8.5.7.CF201706"
            },
            {
              "status": "affected",
              "version": "8.5.7.CF201703"
            },
            {
              "status": "affected",
              "version": "8.5.7.CF201612"
            },
            {
              "status": "affected",
              "version": "8.5.7.CF201609"
            },
            {
              "status": "affected",
              "version": "8.5.7.CF201606"
            },
            {
              "status": "affected",
              "version": "8.5.7"
            },
            {
              "status": "affected",
              "version": "8.5.6.2"
            },
            {
              "status": "affected",
              "version": "8.5.6.1"
            },
            {
              "status": "affected",
              "version": "8.5.6"
            },
            {
              "status": "affected",
              "version": "8.6"
            },
            {
              "status": "affected",
              "version": "8.5.0.2"
            },
            {
              "status": "affected",
              "version": "8.5.0.1"
            },
            {
              "status": "affected",
              "version": "8.5"
            }
          ]
        }
      ],
      "datePublic": "2021-12-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 6.1,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/I:L/PR:L/C:L/S:C/UI:N/AC:L/AV:N/A:N/RC:C/RL:O/E:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-Site Scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-21T19:10:14",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6527782"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6526488"
        },
        {
          "name": "ibm-baw-cve202138893-xss (209512)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2021-12-20T00:00:00",
          "ID": "CVE-2021-38893",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cloud Pak for Automation",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "21.0.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Business Process Manager Standard",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "8.5.5"
                          },
                          {
                            "version_value": "8.5.7.CF201706"
                          },
                          {
                            "version_value": "8.5.7.CF201703"
                          },
                          {
                            "version_value": "8.5.7.CF201612"
                          },
                          {
                            "version_value": "8.5.7.CF201609"
                          },
                          {
                            "version_value": "8.5.7.CF201606"
                          },
                          {
                            "version_value": "8.5.7"
                          },
                          {
                            "version_value": "8.5.6.2"
                          },
                          {
                            "version_value": "8.5.6.1"
                          },
                          {
                            "version_value": "8.5.6"
                          },
                          {
                            "version_value": "8.6"
                          },
                          {
                            "version_value": "8.5.0.2"
                          },
                          {
                            "version_value": "8.5.0.1"
                          },
                          {
                            "version_value": "8.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "L",
              "I": "L",
              "PR": "L",
              "S": "C",
              "UI": "N"
            },
            "TM": {
              "E": "H",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-Site Scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6527782",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6527782 (Business Process Manager Standard)",
              "url": "https://www.ibm.com/support/pages/node/6527782"
            },
            {
              "name": "https://www.ibm.com/support/pages/node/6526488",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6526488 (Cloud Pak for Automation)",
              "url": "https://www.ibm.com/support/pages/node/6526488"
            },
            {
              "name": "ibm-baw-cve202138893-xss (209512)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209512"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2021-38893",
    "datePublished": "2021-12-21T19:10:14.320475Z",
    "dateReserved": "2021-08-16T00:00:00",
    "dateUpdated": "2024-09-17T00:26:52.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-15537

CVE-2021-38893 (GCVE-0-2021-38893)

Tags

Sightings

Nomenclature