SQL Injection Vulnerability in IBM Business Process Manager and Automation Workflow
CVE-2019-4669

6.3MEDIUM

Key Information:

Vendor
IBM
Status
Business Automation Workflow
Business Process Manager
Vendor
CVE Published:
27 February 2020

Summary

The vulnerability allows remote attackers to exploit improper input validation in IBM Business Process Manager and IBM Business Automation Workflow. By injecting specially crafted SQL statements, an attacker could gain unauthorized access to the back-end database, enabling them to view, add, modify, or delete critical information. The affected versions include specific builds of IBM Business Process Manager and IBM Business Automation Workflow, making it crucial for users to apply necessary patches to mitigate this risk.

Affected Version(s)

Business Automation Workflow 18.0.0.1

Business Automation Workflow 19.0.0.3

Business Process Manager 8.6.0.0

References

https://www.ibm.com/support/pages/node/3552261
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/171254
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.