IBM Business Automation Workflow
En bref
- Source
- NVD
- EPSS
- EPSS 0.93 % · centile 60 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ibm
- Statut NVD
- Modified
Description
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.
Faiblesses (CWE)
- CWE-522 — Identifiants insuffisamment protégés
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.9 | CVSS:3.0/I:N/PR:H/AC:L/S:U/AV:N/A:N/UI:N/C:H/E:U/RL:O/RC:C | ibm |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | MEDIUM 4.9 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-25483
- GCVE · GCVE-0-2021-39046
Configurations affectées (CPE NVD)
cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| IBM · Business Automation Workflow | affected 18.0.0.0 ; affected 18.0.0.1 ; affected 18.0.0.2 ; affected 19.0.0.1 ; affected 19.0.0.2 ; affected 19.0.0.3 |
| IBM · Business Process Manager | affected 8.5 ; affected 8.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |