Cross-Site Scripting Vulnerability in IBM Business Automation Workflow and Process Manager
CVE-2021-38883

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Business Process Manager
Business Automation Workflow
Vendor
CVE Published:
17 December 2021

Summary

IBM Business Automation Workflow versions 18.0, 19.0, 20.0, and 21.0, along with IBM Business Process Manager versions 8.5 and 8.6, are subject to a cross-site scripting vulnerability. This flaw enables attackers to inject arbitrary JavaScript code into the web user interface, which could manipulate the application's functionality and lead to unintended actions, including the potential exposure of sensitive user credentials during a session deemed trustworthy. Organizations utilizing these software solutions should ensure immediate remediation measures are in place.

Affected Version(s)

Business Automation Workflow 19.0.0

Business Automation Workflow 20.0.0

Business Automation Workflow 21.0

References

https://www.ibm.com/support/pages/node/6527270
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/209165
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.