IBM Business Automation Workflow
En bref
- Source
- NVD
- EPSS
- EPSS 0.68 % · centile 52 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ibm
- Statut NVD
- Modified
Description
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.4 | CVSS:3.0/AC:L/UI:R/AV:N/I:L/PR:L/A:N/S:C/C:L/RL:O/E:H/RC:C | ibm |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | MEDIUM 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-13756
- GCVE · GCVE-0-2019-4149
Configurations affectées (CPE NVD)
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*≥ 18.0.0.0 ≤ 18.0.0.2cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201712:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| IBM · Business Automation Workflow | affected 18.0.0.0 ; affected 18.0.0.2 |
| IBM · Business Process Manager | affected 8.6.0.0 ; affected 8.5.6.0 ; affected 8.5.6.0CF2 ; affected 8.5.7.0 ; affected 8.5.7.0CF2017.06 ; affected 8.6.0.0CF2018.03 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |