Vulnerabilites related to ibm - cloud_pak_for_business_automation
CVE-2025-1838 (GCVE-0-2025-1838)
Vulnerability from cvelistv5
Published
2025-05-03 18:23
Modified
2025-05-05 14:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-602 - Client-Side Enforcement of Server-Side Security
Summary
IBM Cloud Pak for Business Automation
24.0.0 and 24.0.1 through 24.0.1 IF001
Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 24.0.1 ≤ 24.0.1 IF001 Version: 24.0.0 ≤ 24.0.0 IF004 cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:if004:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:if001:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1838",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-05T14:40:22.215378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-05T14:57:15.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:if004:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:if001:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "24.0.1 IF001",
"status": "affected",
"version": "24.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.0.0 IF004",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM Cloud Pak for Business Automation\u003c/span\u003e\n\n 24.0.0 and 24.0.1 through 24.0.1 IF001 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAuthoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.\u003c/span\u003e"
}
],
"value": "IBM Cloud Pak for Business Automation\n\n 24.0.0 and 24.0.1 through 24.0.1 IF001 \n\nAuthoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-602",
"description": "CWE-602 Client-Side Enforcement of Server-Side Security",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-03T18:23:26.127Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7232429"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF001 Apply security fix 24.0.1-IF002\u003cbr\u003eIBM Cloud Pak for Business Automation V24.0.0 - V24.0.1-IF004 Upgrade and apply security fix 24.0.0-IF005"
}
],
"value": "IBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF001 Apply security fix 24.0.1-IF002\nIBM Cloud Pak for Business Automation V24.0.0 - V24.0.1-IF004 Upgrade and apply security fix 24.0.0-IF005"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation denial of service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2025-1838",
"datePublished": "2025-05-03T18:23:26.127Z",
"dateReserved": "2025-03-02T14:31:16.519Z",
"dateUpdated": "2025-05-05T14:57:15.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32339 (GCVE-0-2023-32339)
Vulnerability from cvelistv5
Published
2023-06-27 16:57
Modified
2024-11-06 20:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 255587.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Business Automation Workflow |
Version: 19.0.0.1 ≤ 19.0.0.3 Version: 20.0.0.1 ≤ 20.0.0.2 Version: 21.0.1 ≤ 21.0.3.1 Version: 21.0.1 ≤ 22.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:10:24.941Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://https://www.ibm.com/support/pages/node/7001291"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://https://www.ibm.com/support/pages/node/6998727"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6998727"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T20:42:49.082015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T20:43:01.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "19.0.0.3",
"status": "affected",
"version": "19.0.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.0.0.2",
"status": "affected",
"version": "20.0.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.0.3.1",
"status": "affected",
"version": "21.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.0.2",
"status": "affected",
"version": "21.0.1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 255587."
}
],
"value": "IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 255587."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-27T16:57:53.458Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://https://www.ibm.com/support/pages/node/7001291"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://https://www.ibm.com/support/pages/node/6998727"
},
{
"tags": [
"vdb-entry"
],
"url": "https://www.ibm.com/support/pages/node/6998727"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-32339",
"datePublished": "2023-06-27T16:57:53.458Z",
"dateReserved": "2023-05-08T18:32:52.654Z",
"dateUpdated": "2024-11-06T20:43:01.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-38367 (GCVE-0-2023-38367)
Vulnerability from cvelistv5
Published
2024-02-29 02:13
Modified
2025-03-27 14:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CVE-287 Improper Authentication
Summary
IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_automation:18.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:18.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:18.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:19.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:19.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:19.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.2:-:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:21.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:21.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:22.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_automation:22.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "cloud_pak_for_automation",
"vendor": "ibm",
"versions": [
{
"status": "affected",
"version": "18.0.0"
},
{
"status": "affected",
"version": "18.0.1"
},
{
"status": "affected",
"version": "18.0.2"
},
{
"status": "affected",
"version": "19.0.1"
},
{
"status": "affected",
"version": "19.0.2"
},
{
"status": "affected",
"version": "19.0.3"
},
{
"status": "affected",
"version": "20.0.1"
},
{
"status": "affected",
"version": "20.0.2"
},
{
"status": "affected",
"version": "20.0.3"
},
{
"status": "affected",
"version": "21.0.1"
},
{
"status": "affected",
"version": "21.0.2"
},
{
"status": "affected",
"version": "21.0.3"
},
{
"status": "affected",
"version": "22.0.1"
},
{
"status": "affected",
"version": "22.0.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-01T16:19:47.030118Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T14:58:22.035Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:39:12.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7015271"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/261130"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130."
}
],
"value": "IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CVE-287 Improper Authentication",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-29T02:13:16.103Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7015271"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/261130"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Automation authentication bypass",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-38367",
"datePublished": "2024-02-29T02:13:16.103Z",
"dateReserved": "2023-07-16T00:53:13.214Z",
"dateUpdated": "2025-03-27T14:58:22.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52365 (GCVE-0-2024-52365)
Vulnerability from cvelistv5
Published
2025-02-05 11:28
Modified
2025-02-22 22:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2
is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52365",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T14:06:09.177329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:30.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation\u0026nbsp;18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eis vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.\u003c/span\u003e"
}
],
"value": "IBM Cloud Pak for Business Automation\u00a018.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 \n\nis vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-22T22:09:50.667Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7182403"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-52365",
"datePublished": "2025-02-05T11:28:32.866Z",
"dateReserved": "2024-11-10T16:11:09.567Z",
"dateUpdated": "2025-02-22T22:09:50.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-50959 (GCVE-0-2023-50959)
Vulnerability from cvelistv5
Published
2024-03-31 11:56
Modified
2024-08-02 22:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-497 - Exposure of System Data to an Unauthorized Control Sphere
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, 23.0.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-01T19:25:55.193811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:22:23.258Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:23:43.912Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7145492"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275938"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, 23.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938."
}
],
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497 Exposure of System Data to an Unauthorized Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-31T11:56:26.054Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7145492"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275938"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation information disclosure",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-50959",
"datePublished": "2024-03-31T11:56:26.054Z",
"dateReserved": "2023-12-16T19:35:51.572Z",
"dateUpdated": "2024-08-02T22:23:43.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-29859 (GCVE-0-2021-29859)
Vulnerability from cvelistv5
Published
2022-05-02 16:55
Modified
2024-09-16 18:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Obtain Information
Summary
IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0 Version: 18.0.1 Version: 18.0.2 Version: 19.0.1 Version: 19.0.2 Version: 19.0.3 Version: 20.0.1 Version: 20.0.2 Version: 20.0.3 Version: 21.0.1 Version: 21.0.2 Version: 21.0.3 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:03.077Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6578583"
},
{
"name": "ibm-icp4a-cve202129859-info-disc (206081)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206081"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0"
},
{
"status": "affected",
"version": "18.0.1"
},
{
"status": "affected",
"version": "18.0.2"
},
{
"status": "affected",
"version": "19.0.1"
},
{
"status": "affected",
"version": "19.0.2"
},
{
"status": "affected",
"version": "19.0.3"
},
{
"status": "affected",
"version": "20.0.1"
},
{
"status": "affected",
"version": "20.0.2"
},
{
"status": "affected",
"version": "20.0.3"
},
{
"status": "affected",
"version": "21.0.1"
},
{
"status": "affected",
"version": "21.0.2"
},
{
"status": "affected",
"version": "21.0.3"
}
]
}
],
"datePublic": "2022-04-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 3.1,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/S:U/A:N/AV:P/PR:N/AC:L/C:L/I:L/UI:N/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-02T16:55:10",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6578583"
},
{
"name": "ibm-icp4a-cve202129859-info-disc (206081)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206081"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2022-04-29T00:00:00",
"ID": "CVE-2021-29859",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cloud Pak for Business Automation",
"version": {
"version_data": [
{
"version_value": "18.0.0"
},
{
"version_value": "18.0.1"
},
{
"version_value": "18.0.2"
},
{
"version_value": "19.0.1"
},
{
"version_value": "19.0.2"
},
{
"version_value": "19.0.3"
},
{
"version_value": "20.0.1"
},
{
"version_value": "20.0.2"
},
{
"version_value": "20.0.3"
},
{
"version_value": "21.0.1"
},
{
"version_value": "21.0.2"
},
{
"version_value": "21.0.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "P",
"C": "L",
"I": "L",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6578583",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6578583 (Cloud Pak for Business Automation)",
"url": "https://www.ibm.com/support/pages/node/6578583"
},
{
"name": "ibm-icp4a-cve202129859-info-disc (206081)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206081"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29859",
"datePublished": "2022-05-02T16:55:10.569183Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-16T18:49:20.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37528 (GCVE-0-2024-37528)
Vulnerability from cvelistv5
Published
2024-07-08 02:21
Modified
2024-08-02 03:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 294293.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, 23.0.2 cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37528",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-12T20:46:38.278319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-12T20:46:45.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:57:39.527Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294293"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, 23.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 294293."
}
],
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 294293."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T02:21:50.815Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294293"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-37528",
"datePublished": "2024-07-08T02:21:50.815Z",
"dateReserved": "2024-06-09T13:59:02.606Z",
"dateUpdated": "2024-08-02T03:57:39.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31897 (GCVE-0-2024-31897)
Vulnerability from cvelistv5
Published
2024-07-08 02:01
Modified
2024-08-02 01:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178.
References
| ► | URL | Tags |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, 23.0.2 cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-12T20:46:58.827522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-12T20:47:05.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:59:50.613Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
},
{
"tags": [
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, 23.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178."
}
],
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T02:01:23.947Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation server-side request forgery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-31897",
"datePublished": "2024-07-08T02:01:23.947Z",
"dateReserved": "2024-04-07T12:44:57.196Z",
"dateUpdated": "2024-08-02T01:59:50.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-36023 (GCVE-0-2025-36023)
Vulnerability from cvelistv5
Published
2025-08-08 14:51
Modified
2025-08-08 15:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 24.0.0 ≤ 24.0.0 IF005 Version: 24.0.1 ≤ 24.0.1 IF002 cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:ifix5:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:ifix2:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-36023",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-08T15:07:06.250680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-08T15:07:16.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:ifix5:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:ifix2:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "24.0.0 IF005",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.0.1 IF002",
"status": "affected",
"version": "24.0.1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key."
}
],
"value": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-08T14:51:12.631Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7241570"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected Product(s) Version(s) Remediation / Fix\u003cbr\u003eIBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF002 Apply security fix 24.0.1-IF004 or upgrade to V25.0.0\u003cbr\u003eIBM Cloud Pak for Business Automation V24.0.0 - V24.0.0-IF005 Upgrade and apply security fix 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0\u003cbr\u003eIBM Cloud Pak for Business Automation earlier unsupported releases Upgrade to 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Affected Product(s) Version(s) Remediation / Fix\nIBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF002 Apply security fix 24.0.1-IF004 or upgrade to V25.0.0\nIBM Cloud Pak for Business Automation V24.0.0 - V24.0.0-IF005 Upgrade and apply security fix 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0\nIBM Cloud Pak for Business Automation earlier unsupported releases Upgrade to 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation security bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2025-36023",
"datePublished": "2025-08-08T14:51:12.631Z",
"dateReserved": "2025-04-15T21:16:08.835Z",
"dateUpdated": "2025-08-08T15:07:16.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35899 (GCVE-0-2023-35899)
Vulnerability from cvelistv5
Published
2024-03-05 18:55
Modified
2024-08-02 18:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Summary
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:37:40.037Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7030357"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/259354"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "cloud_pak_for_business_automation",
"vendor": "ibm",
"versions": [
{
"lessThanOrEqual": "18.0.2",
"status": "affected",
"version": "18.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "19.0.3",
"status": "affected",
"version": "19.0.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "20.0.3",
"status": "affected",
"version": "20.0.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.0.1_if008",
"status": "affected",
"version": "21.0.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.0.2_if005",
"status": "affected",
"version": "22.0.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "23.0.1_if001",
"status": "affected",
"version": "23.0.1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "cloud_pak_for_business_automation",
"vendor": "ibm",
"versions": [
{
"lessThanOrEqual": "21.0.3_if023",
"status": "affected",
"version": "21.0.3",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-02T18:35:54.058746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-02T18:59:01.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354."
}
],
"value": "IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CWE-1236 Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-05T18:55:44.903Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7030357"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/259354"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Automation CSV injection",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-35899",
"datePublished": "2024-03-05T18:55:44.903Z",
"dateReserved": "2023-06-20T02:24:31.593Z",
"dateUpdated": "2024-08-02T18:59:01.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22860 (GCVE-0-2023-22860)
Vulnerability from cvelistv5
Published
2023-02-27 14:23
Modified
2025-03-10 13:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:31.090Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6958062"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244100"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T13:48:20.585882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T13:48:36.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100."
}
],
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-27T14:23:44.782Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6958062"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244100"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-22860",
"datePublished": "2023-02-27T14:23:44.782Z",
"dateReserved": "2023-01-09T15:16:41.368Z",
"dateUpdated": "2025-03-10T13:48:36.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40691 (GCVE-0-2023-40691)
Vulnerability from cvelistv5
Published
2023-12-18 20:29
Modified
2024-08-02 18:38
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:38:51.164Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7096365"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/264805"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805."
}
],
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-18T20:29:00.344Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7096365"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/264805"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation information disclosure",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-40691",
"datePublished": "2023-12-18T20:29:00.344Z",
"dateReserved": "2023-08-18T15:48:06.502Z",
"dateUpdated": "2024-08-02T18:38:51.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41753 (GCVE-0-2024-41753)
Vulnerability from cvelistv5
Published
2025-05-03 16:06
Modified
2025-05-05 14:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Summary
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 24.0.0 ≤ 24.0.0 IF004 Version: 24.0.1 ≤ 24.0.1 IF001 cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:if004:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:if001:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-05T14:40:27.542654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-05T14:57:29.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:if004:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:if001:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "24.0.0 IF004",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.0.1 IF001",
"status": "affected",
"version": "24.0.1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"value": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-03T16:07:32.201Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7232197"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF001 Apply security fix 24.0.1-IF002\u003cbr\u003eIBM Cloud Pak for Business Automation V24.0.0 - V24.0.0-IF004 Apply security fix 24.0.0-IF005 or upgrade to 24.0.1-IF002"
}
],
"value": "IBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF001 Apply security fix 24.0.1-IF002\nIBM Cloud Pak for Business Automation V24.0.0 - V24.0.0-IF004 Apply security fix 24.0.0-IF005 or upgrade to 24.0.1-IF002"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-41753",
"datePublished": "2025-05-03T16:06:18.716Z",
"dateReserved": "2024-07-22T12:02:37.814Z",
"dateUpdated": "2025-05-05T14:57:29.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35024 (GCVE-0-2023-35024)
Vulnerability from cvelistv5
Published
2023-10-14 15:07
Modified
2024-09-16 20:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:17:04.264Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7047198"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/258349"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35024",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-16T20:09:45.666384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-16T20:09:53.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349."
}
],
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-14T15:07:18.696Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7047198"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/258349"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-35024",
"datePublished": "2023-10-14T15:07:18.696Z",
"dateReserved": "2023-06-11T20:38:21.242Z",
"dateUpdated": "2024-09-16T20:09:53.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-49348 (GCVE-0-2024-49348)
Vulnerability from cvelistv5
Published
2025-02-05 11:30
Modified
2025-02-22 21:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-266 - Incorrect Privilege Assignment
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2
allows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T14:05:40.990412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:30.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation\u0026nbsp;18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context.\u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "IBM Cloud Pak for Business Automation\u00a018.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 \n\n\n\nallows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-22T21:00:11.012Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7182403"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation incorrect privilege assignment",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-49348",
"datePublished": "2025-02-05T11:30:05.572Z",
"dateReserved": "2024-10-14T12:05:24.914Z",
"dateUpdated": "2025-02-22T21:00:11.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52364 (GCVE-0-2024-52364)
Vulnerability from cvelistv5
Published
2025-02-05 11:22
Modified
2025-02-22 22:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T14:06:15.632172Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:30.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Cloud Pak for Business Automation\u0026nbsp;18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"value": "IBM Cloud Pak for Business Automation\u00a018.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-22T22:09:19.772Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7182403"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-52364",
"datePublished": "2025-02-05T11:22:17.219Z",
"dateReserved": "2024-11-10T16:11:09.567Z",
"dateUpdated": "2025-02-22T22:09:19.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23469 (GCVE-0-2023-23469)
Vulnerability from cvelistv5
Published
2023-02-01 18:12
Modified
2025-03-26 15:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- 525 Information Exposure Through Browser Caching
Summary
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation |
Version: 18.0.0, 18.0.1,18.0.2,19.0.1,19.0.2,19.0.3,20.0.1,20.0.2,20.0.3,21.0.1,21.0.2,21.0.3,22.0.1,22.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:28:40.942Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6857999"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244504"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-23469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-26T15:06:44.232829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-525",
"description": "CWE-525 Use of Web Browser Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-26T15:08:13.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Pak for Business Automation",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0, 18.0.1,18.0.2,19.0.1,19.0.2,19.0.3,20.0.1,20.0.2,20.0.3,21.0.1,21.0.2,21.0.3,22.0.1,22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(204, 217, 226);\"\u003eIBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.\u003c/span\u003e\n\n"
}
],
"value": "\nIBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "525 Information Exposure Through Browser Caching",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-01T18:12:22.589Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857999"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244504"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Cloud Pak for Business Automation information disclosure",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-23469",
"datePublished": "2023-02-01T18:12:22.589Z",
"dateReserved": "2023-01-12T16:24:46.603Z",
"dateUpdated": "2025-03-26T15:08:13.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-50947 (GCVE-0-2023-50947)
Vulnerability from cvelistv5
Published
2024-02-04 00:11
Modified
2024-08-22 17:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM | Business Automation Workflow |
Version: 22.0.2, 23.0.1, 23.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:23:44.041Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50947",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-22T17:40:47.403078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T17:41:47.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "22.0.2, 23.0.1, 23.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665."
}
],
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-04T00:11:02.465Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Business Automation Workflow cross-site scripting",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2023-50947",
"datePublished": "2024-02-04T00:11:02.465Z",
"dateReserved": "2023-12-16T19:35:35.358Z",
"dateUpdated": "2024-08-22T17:41:47.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2024-07-08 03:15
Modified
2024-11-21 09:24
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 294293.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/294293 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7159332 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/294293 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7159332 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "716DF694-558C-4115-B70E-E434602BA933",
"versionEndIncluding": "18.0.2",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00B3BADE-C2D9-40BC-BAD0-39FCA9FC563B",
"versionEndIncluding": "19.0.3",
"versionStartIncluding": "19.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F99EDA35-605B-4AC3-AFFA-F6507F1DD8E5",
"versionEndIncluding": "20.0.3",
"versionStartIncluding": "20.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "60AC2B63-2F8A-40E7-B2E0-4A06F79E1F7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:*",
"matchCriteriaId": "5F109F93-1CE8-4F86-9070-73012ED0FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_024:*:*:*:*:*:*",
"matchCriteriaId": "6CC66606-EE8D-4273-832A-4A0391B5DBAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_025:*:*:*:*:*:*",
"matchCriteriaId": "8CEF57DE-61D6-41E6-8C34-06A1F859F9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_026:*:*:*:*:*:*",
"matchCriteriaId": "7C441A0C-5FE4-4F7A-8E88-85E198790D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_028:*:*:*:*:*:*",
"matchCriteriaId": "9A6F6F2E-0ED8-4478-BFC5-92C736323A63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_029:*:*:*:*:*:*",
"matchCriteriaId": "1D823E07-4F45-4EBC-99AF-81C412330586",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_030:*:*:*:*:*:*",
"matchCriteriaId": "AE588317-A913-429C-88E8-059425506E47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_031:*:*:*:*:*:*",
"matchCriteriaId": "B0E18893-9158-4712-B879-7ADD2EB619AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_032:*:*:*:*:*:*",
"matchCriteriaId": "DFBF74EF-1B70-4FDE-A13F-6695C72E4638",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_033:*:*:*:*:*:*",
"matchCriteriaId": "C3A5C102-A3D4-456D-B985-E556E37044A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "31BC7CBD-C728-481C-AC5F-110FD7799B6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "49793CE0-A419-4937-89B4-B6A8F0E22C0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "E7ABFE27-D890-4AF4-8686-296F4DB90F73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "BE746B2B-EECA-4332-9A24-8EF23BDA1B52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "CEE539C9-6AF2-4B02-8916-2AC7D4A93C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "72743164-5279-4FB6-86EE-EBE5B8CD6D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "7A81368D-744B-4886-96C7-1755A27C0AAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "5B823170-57D5-4329-B41A-6C347982E00B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAE375C3-E995-415F-A349-A45998764910",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "A402E881-759D-4B59-985D-4DDA49327147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "939B5364-0CF8-480A-B15A-B1FD9D9560EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "9BD80442-5DB1-44AC-B4FC-6EDF4162586B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "01632D44-1A4A-4C1A-A19D-8E815617B905",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "12CE606B-49F1-425F-A00B-23E3C91CCB0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "581B838C-3242-46E8-B2A7-343734FEA3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "287F9B5E-AD36-422B-80D5-9B51BA64F993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "0B20AAF4-0EC3-467A-96C6-102124A191DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "0EA264AE-2691-4C84-BAB6-82BEECC7435F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "91E7E70A-765F-47EC-8DDD-82BFFE14A6C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "F3A493A2-6835-4A52-9C0C-1C828C3AF662",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "F5D82427-AC22-4C48-9AC8-B1922082FDF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "0767E445-1D61-4879-AB3A-2E6259CF4AF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "BA3388C6-DFAD-403E-9699-305B2146B883",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 294293."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1 y 23.0.2 son vulnerables a Cross Site Scripting. Esta vulnerabilidad permite a un usuario privilegiado incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 294293."
}
],
"id": "CVE-2024-37528",
"lastModified": "2024-11-21T09:24:00.887",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-07-08T03:15:02.450",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294293"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294293"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-03-31 12:15
Modified
2024-11-21 08:37
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/275938 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7145492 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/275938 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7145492 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 18.0.0 | |
| ibm | cloud_pak_for_business_automation | 18.0.1 | |
| ibm | cloud_pak_for_business_automation | 18.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.1 | |
| ibm | cloud_pak_for_business_automation | 19.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.3 | |
| ibm | cloud_pak_for_business_automation | 20.0.1 | |
| ibm | cloud_pak_for_business_automation | 20.0.2 | |
| ibm | cloud_pak_for_business_automation | 20.0.3 | |
| ibm | cloud_pak_for_business_automation | 21.0.1 | |
| ibm | cloud_pak_for_business_automation | 21.0.2 | |
| ibm | cloud_pak_for_business_automation | 21.0.3 | |
| ibm | cloud_pak_for_business_automation | 22.0.1 | |
| ibm | cloud_pak_for_business_automation | 22.0.2 | |
| ibm | cloud_pak_for_business_automation | 23.0.1 | |
| ibm | cloud_pak_for_business_automation | 23.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "01632D44-1A4A-4C1A-A19D-8E815617B905",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "0EA264AE-2691-4C84-BAB6-82BEECC7435F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938."
},
{
"lang": "es",
"value": "IBM Cloud Pak para automatizaci\u00f3n empresarial 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1 y 23.0.2 pueden permitir a los usuarios finales consultar m\u00e1s documentos de los esperados desde un sistema de gesti\u00f3n de contenido empresarial conectado cuando se configura para usar una cuenta del sistema. ID de IBM X-Force: 275938."
}
],
"id": "CVE-2023-50959",
"lastModified": "2024-11-21T08:37:36.643",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-03-31T12:15:50.130",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275938"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7145492"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275938"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7145492"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-497"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-14 16:15
Modified
2024-11-21 08:07
Severity ?
4.6 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/258349 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7047198 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/258349 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7047198 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 18.0.0 | |
| ibm | cloud_pak_for_business_automation | 18.0.1 | |
| ibm | cloud_pak_for_business_automation | 18.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.1 | |
| ibm | cloud_pak_for_business_automation | 19.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.3 | |
| ibm | cloud_pak_for_business_automation | 20.0.1 | |
| ibm | cloud_pak_for_business_automation | 20.0.2 | |
| ibm | cloud_pak_for_business_automation | 20.0.3 | |
| ibm | cloud_pak_for_business_automation | 21.0.1 | |
| ibm | cloud_pak_for_business_automation | 21.0.2 | |
| ibm | cloud_pak_for_business_automation | 21.0.3 | |
| ibm | cloud_pak_for_business_automation | 22.0.1 | |
| ibm | cloud_pak_for_business_automation | 22.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349."
},
{
"lang": "es",
"value": "IBM Cloud Pak para Automatizaci\u00f3n Empresarial 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 y 22.0.2 son vulnerables a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 258349."
}
],
"id": "CVE-2023-35024",
"lastModified": "2024-11-21T08:07:50.453",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 2.5,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 4.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-14T16:15:10.670",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/258349"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7047198"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/258349"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7047198"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-02-01 19:15
Modified
2025-03-26 15:15
Severity ?
4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7452A304-5579-42B5-BE6E-3A8D52E5BC2E",
"versionEndIncluding": "20.0.3",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "5EB47B7D-C408-4ED1-9D98-8BF77FFEF8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_0012:*:*:*:*:*:*",
"matchCriteriaId": "02D22CC4-3541-4BAA-8B45-FEB41F2E1697",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "E8859A71-36FD-4E83-B8C6-BEEF772AB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAEF9352-EDCB-4D16-B3F9-11962D3E9F50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "F5C8892F-A803-4E3F-8992-5011B2E73C3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "4890680E-8D82-46DB-9346-3C26D8C9F7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "4F11DDE3-29C4-4CC4-AF73-DF7CCC73D5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "358590C1-6CAF-4FA7-9975-C9DD41242B1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "9C2A88F1-55B3-43A9-8051-71C467A6712F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "E06C0789-2CC4-4D57-87D0-C0FAB9DB1B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nIBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504.\n\n"
}
],
"id": "CVE-2023-23469",
"lastModified": "2025-03-26T15:15:46.320",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.5,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-01T19:15:08.690",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Broken Link"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244504"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857999"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244504"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6857999"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-525"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-05-02 17:15
Modified
2024-11-21 06:01
Severity ?
Summary
IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/206081 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6578583 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/206081 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6578583 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "5EB47B7D-C408-4ED1-9D98-8BF77FFEF8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "E8859A71-36FD-4E83-B8C6-BEEF772AB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAEF9352-EDCB-4D16-B3F9-11962D3E9F50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "F5C8892F-A803-4E3F-8992-5011B2E73C3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "4890680E-8D82-46DB-9346-3C26D8C9F7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "4F11DDE3-29C4-4CC4-AF73-DF7CCC73D5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "358590C1-6CAF-4FA7-9975-C9DD41242B1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "9C2A88F1-55B3-43A9-8051-71C467A6712F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "E06C0789-2CC4-4D57-87D0-C0FAB9DB1B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081."
},
{
"lang": "es",
"value": "IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation versiones V21.0.3 hasta V21.0.3-IF008, versiones V21.0.2 hasta V21.0.2-IF009, y versiones V21.0.1 hasta V21.0.1-IF007) podr\u00eda permitir a un usuario con acceso f\u00edsico al sistema llevar a cabo acciones no autorizadas u obtener informaci\u00f3n confidencial debido a una insuficiente comprobaci\u00f3n y revocaci\u00f3n del cierre de sesi\u00f3n de otro usuario. IBM X-Force ID: 206081"
}
],
"id": "CVE-2021-29859",
"lastModified": "2024-11-21T06:01:55.767",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 0.9,
"impactScore": 2.5,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-02T17:15:07.747",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206081"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6578583"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206081"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6578583"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-02-05 12:15
Modified
2025-08-12 16:36
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2
allows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7182403 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 18.0.0 | |
| ibm | cloud_pak_for_business_automation | 18.0.1 | |
| ibm | cloud_pak_for_business_automation | 18.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.1 | |
| ibm | cloud_pak_for_business_automation | 19.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.3 | |
| ibm | cloud_pak_for_business_automation | 20.0.1 | |
| ibm | cloud_pak_for_business_automation | 20.0.2 | |
| ibm | cloud_pak_for_business_automation | 20.0.3 | |
| ibm | cloud_pak_for_business_automation | 21.0.1 | |
| ibm | cloud_pak_for_business_automation | 21.0.2 | |
| ibm | cloud_pak_for_business_automation | 21.0.3 | |
| ibm | cloud_pak_for_business_automation | 22.0.1 | |
| ibm | cloud_pak_for_business_automation | 22.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation\u00a018.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 \n\n\n\nallows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 y 22.0.2 permiten restringir el acceso a los datos de la organizaci\u00f3n a contextos v\u00e1lidos. El hecho de que las tareas de tipo comentario se puedan reasignar a trav\u00e9s de la API otorga impl\u00edcitamente acceso a las consultas de los usuarios en un contexto inesperado."
}
],
"id": "CVE-2024-49348",
"lastModified": "2025-08-12T16:36:42.023",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-05T12:15:28.570",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7182403"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-266"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-02-27 15:15
Modified
2024-11-21 07:45
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/244100 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6958062 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/244100 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6958062 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "5EB47B7D-C408-4ED1-9D98-8BF77FFEF8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_0012:*:*:*:*:*:*",
"matchCriteriaId": "02D22CC4-3541-4BAA-8B45-FEB41F2E1697",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "E8859A71-36FD-4E83-B8C6-BEEF772AB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAEF9352-EDCB-4D16-B3F9-11962D3E9F50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "F5C8892F-A803-4E3F-8992-5011B2E73C3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "4890680E-8D82-46DB-9346-3C26D8C9F7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "4F11DDE3-29C4-4CC4-AF73-DF7CCC73D5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "358590C1-6CAF-4FA7-9975-C9DD41242B1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "9C2A88F1-55B3-43A9-8051-71C467A6712F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "E06C0789-2CC4-4D57-87D0-C0FAB9DB1B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "3B207F2D-B5F2-4B0C-863A-AD1620633A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "5E3468FC-CB4C-4EFE-A1ED-46F780ABB703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "D26A78C9-525C-43B3-88FF-9A6AC62A6C7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "31BC7CBD-C728-481C-AC5F-110FD7799B6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "49793CE0-A419-4937-89B4-B6A8F0E22C0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "E7ABFE27-D890-4AF4-8686-296F4DB90F73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "BE746B2B-EECA-4332-9A24-8EF23BDA1B52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "CEE539C9-6AF2-4B02-8916-2AC7D4A93C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "72743164-5279-4FB6-86EE-EBE5B8CD6D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "7A81368D-744B-4886-96C7-1755A27C0AAD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100."
}
],
"id": "CVE-2023-22860",
"lastModified": "2024-11-21T07:45:32.680",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-27T15:15:11.663",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244100"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6958062"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244100"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6958062"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-08-08 15:15
Modified
2025-08-15 18:19
Severity ?
Summary
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7241570 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EF879B84-21B0-4FD4-AD2E-7F29EBDD218A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "496D1A48-3403-471F-AD07-AEC7E5000AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "D1810412-5987-4F53-A81E-096A4F0187B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "9CC01202-3D62-4544-BE9C-47300063896E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F68528C5-034B-4B2C-8745-B969B14B52C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "EADE80E3-4E60-4154-A559-93E2325D799A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "D01FC35C-29F1-4D57-8804-07A5C1E9EA85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 24.0.0 a 24.0.0 IF005 y 24.0.1 a 24.0.1 IF002 podr\u00edan permitir que un usuario autenticado vea informaci\u00f3n confidencial del usuario y del sistema debido a una referencia de objeto indirecta a trav\u00e9s de una clave controlada por el usuario."
}
],
"id": "CVE-2025-36023",
"lastModified": "2025-08-15T18:19:48.543",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
},
"published": "2025-08-08T15:15:28.087",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7241570"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-29 02:15
Modified
2025-03-27 15:15
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "5EB47B7D-C408-4ED1-9D98-8BF77FFEF8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_0012:*:*:*:*:*:*",
"matchCriteriaId": "02D22CC4-3541-4BAA-8B45-FEB41F2E1697",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "E8859A71-36FD-4E83-B8C6-BEEF772AB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAEF9352-EDCB-4D16-B3F9-11962D3E9F50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "F5C8892F-A803-4E3F-8992-5011B2E73C3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "4890680E-8D82-46DB-9346-3C26D8C9F7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "4F11DDE3-29C4-4CC4-AF73-DF7CCC73D5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "358590C1-6CAF-4FA7-9975-C9DD41242B1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "9C2A88F1-55B3-43A9-8051-71C467A6712F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "E06C0789-2CC4-4D57-87D0-C0FAB9DB1B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "3B207F2D-B5F2-4B0C-863A-AD1620633A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "5E3468FC-CB4C-4EFE-A1ED-46F780ABB703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "D26A78C9-525C-43B3-88FF-9A6AC62A6C7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "31BC7CBD-C728-481C-AC5F-110FD7799B6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "49793CE0-A419-4937-89B4-B6A8F0E22C0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "E7ABFE27-D890-4AF4-8686-296F4DB90F73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "BE746B2B-EECA-4332-9A24-8EF23BDA1B52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "CEE539C9-6AF2-4B02-8916-2AC7D4A93C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "72743164-5279-4FB6-86EE-EBE5B8CD6D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "7A81368D-744B-4886-96C7-1755A27C0AAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "5B823170-57D5-4329-B41A-6C347982E00B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAE375C3-E995-415F-A349-A45998764910",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "A402E881-759D-4B59-985D-4DDA49327147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "939B5364-0CF8-480A-B15A-B1FD9D9560EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "9BD80442-5DB1-44AC-B4FC-6EDF4162586B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "684E6AB2-84C1-4700-B519-88D0C7D8D3CB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130."
},
{
"lang": "es",
"value": "BM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) permite operaciones CRUD con un token no v\u00e1lido. Esto podr\u00eda permitir que un atacante no autenticado vea, actualice, elimine o cree una configuraci\u00f3n de IdP. ID de IBM X-Force: 261130."
}
],
"id": "CVE-2023-38367",
"lastModified": "2025-03-27T15:15:46.923",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-29T02:15:09.120",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/261130"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7015271"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/261130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7015271"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-12-18 21:15
Modified
2024-11-21 08:19
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/264805 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7096365 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/264805 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7096365 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "60AC2B63-2F8A-40E7-B2E0-4A06F79E1F7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:*",
"matchCriteriaId": "5F109F93-1CE8-4F86-9070-73012ED0FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_024:*:*:*:*:*:*",
"matchCriteriaId": "6CC66606-EE8D-4273-832A-4A0391B5DBAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_025:*:*:*:*:*:*",
"matchCriteriaId": "8CEF57DE-61D6-41E6-8C34-06A1F859F9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_026:*:*:*:*:*:*",
"matchCriteriaId": "7C441A0C-5FE4-4F7A-8E88-85E198790D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "7A81368D-744B-4886-96C7-1755A27C0AAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "5B823170-57D5-4329-B41A-6C347982E00B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAE375C3-E995-415F-A349-A45998764910",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "A402E881-759D-4B59-985D-4DDA49327147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "939B5364-0CF8-480A-B15A-B1FD9D9560EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "9BD80442-5DB1-44AC-B4FC-6EDF4162586B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "01632D44-1A4A-4C1A-A19D-8E815617B905",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "12CE606B-49F1-425F-A00B-23E3C91CCB0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "581B838C-3242-46E8-B2A7-343734FEA3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "287F9B5E-AD36-422B-80D5-9B51BA64F993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "0B20AAF4-0EC3-467A-96C6-102124A191DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805."
},
{
"lang": "es",
"value": "IBM Cloud Pak para automatizaci\u00f3n empresarial 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 y 22.0.2 pueden revelar informaci\u00f3n confidencial contenida en la configuraci\u00f3n de la aplicaci\u00f3n a los usuarios desarrolladores y administradores. ID de IBM X-Force: 264805."
}
],
"id": "CVE-2023-40691",
"lastModified": "2024-11-21T08:19:58.663",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-12-18T21:15:08.087",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/264805"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7096365"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/264805"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7096365"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-03-21 02:47
Modified
2025-03-05 19:43
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0413501D-975D-469E-A854-61E12039A8D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06B0B413-0396-4213-9719-C22AEFC7B3E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:*",
"matchCriteriaId": "5F109F93-1CE8-4F86-9070-73012ED0FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C35A26E3-D2F7-466C-9010-06AA76568A1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "59BF1F79-6E1E-49EE-8D8E-B524F040AA29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "01632D44-1A4A-4C1A-A19D-8E815617B905",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "12CE606B-49F1-425F-A00B-23E3C91CCB0B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354."
},
{
"lang": "es",
"value": "IBM Cloud Pak para automatizaci\u00f3n 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0 .3, 22.0.1 y 22.0.2 son potencialmente vulnerables a la inyecci\u00f3n CSV. Un atacante remoto podr\u00eda ejecutar comandos arbitrarios en el sistema, causados por una validaci\u00f3n inadecuada del contenido del archivo csv. ID de IBM X-Force: 259354."
}
],
"id": "CVE-2023-35899",
"lastModified": "2025-03-05T19:43:26.133",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-03-21T02:47:58.550",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/259354"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7030357"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/259354"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7030357"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1236"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-04 01:15
Modified
2024-11-21 08:37
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/275665 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7114419 | Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7114430 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/275665 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7114419 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7114430 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
"versionEndIncluding": "19.0.0.3",
"versionStartIncluding": "19.0.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
"matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
"versionEndIncluding": "21.0.3.1",
"versionStartIncluding": "21.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "EA4F72CF-1AE0-4B3B-BD23-4BFB086C843D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "97316AAE-CB3C-4091-8A36-8FBF050E5B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "CEC71A77-3C31-4362-BAF4-A47ED694F73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*",
"matchCriteriaId": "12725407-1B9F-43B7-8D66-F0E3B0181830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*",
"matchCriteriaId": "00F5E82D-712A-4AB2-B0B2-BF03507D17D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*",
"matchCriteriaId": "0063E78F-2978-43F6-884D-B375E1111E87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*",
"matchCriteriaId": "CF6317BE-98DF-4A46-9F5B-326177D6AD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*",
"matchCriteriaId": "72A22C4B-AAF2-4A84-AF39-C1C396031D98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*",
"matchCriteriaId": "39015A02-D36E-4CC9-A5E3-877DFD923ACD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*",
"matchCriteriaId": "19586E74-8802-4C09-A240-D698EE30C570",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*",
"matchCriteriaId": "4B06D109-E327-4A2A-9FC9-A5F454022C0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*",
"matchCriteriaId": "E67BEF93-133E-4507-B938-79D943AB82CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*",
"matchCriteriaId": "84689E35-3C11-44D2-B719-0F47CC7DE6B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*",
"matchCriteriaId": "05248E0A-BE7C-4AA1-80B8-5397382D742E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*",
"matchCriteriaId": "0852419C-62F1-49BA-BD99-96700D33ED64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:containers:*:*:*",
"matchCriteriaId": "628B7F15-103F-4B84-90ED-EBFAD633BCE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:*:*:containers:*:*:*",
"matchCriteriaId": "91E22A7B-18F4-461C-9986-0CECBAB879F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:*:*:containers:*:*:*",
"matchCriteriaId": "4FE832E4-BE4B-4923-A98D-3B127758C103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:*:*:containers:*:*:*",
"matchCriteriaId": "EE7E0724-C7FB-4436-A702-EC2102205175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "4052CAAA-1247-468F-A528-2DAC2F0C745B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:*",
"matchCriteriaId": "96E5413A-7C63-4066-ADB9-B7A30095D457",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "3E9B8E36-CA86-459C-A0CF-F00F179119FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*",
"matchCriteriaId": "DFB13BEC-206E-41B3-A4F3-9281EBB0E213",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:*",
"matchCriteriaId": "827165FB-FCB2-4684-BFC5-D9560BD7FC03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "7EDE5FAA-6843-486D-BEAA-A82E088A2A74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:traditional:*:*:*",
"matchCriteriaId": "F7C0BC37-0F42-463F-B2E4-F2B3D3958314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:enterprise_service_bus:*:*:*",
"matchCriteriaId": "4283CF30-9B92-4E28-8878-9AF0AAAF24D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "716DF694-558C-4115-B70E-E434602BA933",
"versionEndIncluding": "18.0.2",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00B3BADE-C2D9-40BC-BAD0-39FCA9FC563B",
"versionEndIncluding": "19.0.3",
"versionStartIncluding": "19.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F99EDA35-605B-4AC3-AFFA-F6507F1DD8E5",
"versionEndIncluding": "20.0.3",
"versionStartIncluding": "20.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0413501D-975D-469E-A854-61E12039A8D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:*",
"matchCriteriaId": "5F109F93-1CE8-4F86-9070-73012ED0FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_024:*:*:*:*:*:*",
"matchCriteriaId": "6CC66606-EE8D-4273-832A-4A0391B5DBAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_025:*:*:*:*:*:*",
"matchCriteriaId": "8CEF57DE-61D6-41E6-8C34-06A1F859F9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_026:*:*:*:*:*:*",
"matchCriteriaId": "7C441A0C-5FE4-4F7A-8E88-85E198790D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_028:*:*:*:*:*:*",
"matchCriteriaId": "9A6F6F2E-0ED8-4478-BFC5-92C736323A63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C35A26E3-D2F7-466C-9010-06AA76568A1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "59BF1F79-6E1E-49EE-8D8E-B524F040AA29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "684E6AB2-84C1-4700-B519-88D0C7D8D3CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "78EB3854-3AE9-4AD1-A511-21F02270DB4A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow 22.0.2, 23.0.1 y 23.0.2 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite a los usuarios incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda conducir a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. ID de IBM X-Force: 275665."
}
],
"id": "CVE-2023-50947",
"lastModified": "2024-11-21T08:37:35.167",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-04T01:15:25.040",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7114430"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-08 03:15
Modified
2024-11-21 09:14
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/288178 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7159332 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/288178 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7159332 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "716DF694-558C-4115-B70E-E434602BA933",
"versionEndIncluding": "18.0.2",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00B3BADE-C2D9-40BC-BAD0-39FCA9FC563B",
"versionEndIncluding": "19.0.3",
"versionStartIncluding": "19.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F99EDA35-605B-4AC3-AFFA-F6507F1DD8E5",
"versionEndIncluding": "20.0.3",
"versionStartIncluding": "20.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "60AC2B63-2F8A-40E7-B2E0-4A06F79E1F7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:*",
"matchCriteriaId": "42A67A28-CBF1-4C37-A217-F4789ED1850E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:*",
"matchCriteriaId": "BFEF1033-B100-400A-9B2B-94AEE3A7B94A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:*",
"matchCriteriaId": "5F109F93-1CE8-4F86-9070-73012ED0FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_024:*:*:*:*:*:*",
"matchCriteriaId": "6CC66606-EE8D-4273-832A-4A0391B5DBAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_025:*:*:*:*:*:*",
"matchCriteriaId": "8CEF57DE-61D6-41E6-8C34-06A1F859F9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_026:*:*:*:*:*:*",
"matchCriteriaId": "7C441A0C-5FE4-4F7A-8E88-85E198790D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_028:*:*:*:*:*:*",
"matchCriteriaId": "9A6F6F2E-0ED8-4478-BFC5-92C736323A63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_029:*:*:*:*:*:*",
"matchCriteriaId": "1D823E07-4F45-4EBC-99AF-81C412330586",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_030:*:*:*:*:*:*",
"matchCriteriaId": "AE588317-A913-429C-88E8-059425506E47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_031:*:*:*:*:*:*",
"matchCriteriaId": "B0E18893-9158-4712-B879-7ADD2EB619AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_032:*:*:*:*:*:*",
"matchCriteriaId": "DFBF74EF-1B70-4FDE-A13F-6695C72E4638",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_033:*:*:*:*:*:*",
"matchCriteriaId": "C3A5C102-A3D4-456D-B985-E556E37044A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "31BC7CBD-C728-481C-AC5F-110FD7799B6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "49793CE0-A419-4937-89B4-B6A8F0E22C0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "E7ABFE27-D890-4AF4-8686-296F4DB90F73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "BE746B2B-EECA-4332-9A24-8EF23BDA1B52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "CEE539C9-6AF2-4B02-8916-2AC7D4A93C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "72743164-5279-4FB6-86EE-EBE5B8CD6D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "7A81368D-744B-4886-96C7-1755A27C0AAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "5B823170-57D5-4329-B41A-6C347982E00B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAE375C3-E995-415F-A349-A45998764910",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "A402E881-759D-4B59-985D-4DDA49327147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "939B5364-0CF8-480A-B15A-B1FD9D9560EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "9BD80442-5DB1-44AC-B4FC-6EDF4162586B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "01632D44-1A4A-4C1A-A19D-8E815617B905",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "12CE606B-49F1-425F-A00B-23E3C91CCB0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "581B838C-3242-46E8-B2A7-343734FEA3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "287F9B5E-AD36-422B-80D5-9B51BA64F993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "0B20AAF4-0EC3-467A-96C6-102124A191DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "0EA264AE-2691-4C84-BAB6-82BEECC7435F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "91E7E70A-765F-47EC-8DDD-82BFFE14A6C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "F3A493A2-6835-4A52-9C0C-1C828C3AF662",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "F5D82427-AC22-4C48-9AC8-B1922082FDF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "0767E445-1D61-4879-AB3A-2E6259CF4AF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "BA3388C6-DFAD-403E-9699-305B2146B883",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178."
},
{
"lang": "es",
"value": " IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1 y 23.0.2 vulnerables a Server Side Request Forgery (SSRF). Esto puede permitir que un atacante autenticado env\u00ede solicitudes no autorizadas desde el sistema, lo que podr\u00eda provocar la enumeraci\u00f3n de la red o facilitar otros ataques. ID de IBM X-Force: 288178."
}
],
"id": "CVE-2024-31897",
"lastModified": "2024-11-21T09:14:06.077",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-07-08T03:15:02.200",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7159332"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-05-03 16:15
Modified
2025-08-14 01:51
Severity ?
Summary
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7232197 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EF879B84-21B0-4FD4-AD2E-7F29EBDD218A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "496D1A48-3403-471F-AD07-AEC7E5000AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "AA215EC3-DDFE-494D-862C-35CA30D9BEDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "969ED94C-DB65-482F-B8B8-251B56DE264D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "D1810412-5987-4F53-A81E-096A4F0187B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F68528C5-034B-4B2C-8745-B969B14B52C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "EADE80E3-4E60-4154-A559-93E2325D799A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 24.0.0 a 24.0.0 IF004 y 24.0.1 a 24.0.1 IF001 son vulnerables a ataques de cross-site scripting. Esta vulnerabilidad permite a un atacante no autenticado incrustar c\u00f3digo JavaScript arbitrario en la interfaz web, alterando as\u00ed la funcionalidad prevista y pudiendo provocar la divulgaci\u00f3n de credenciales en una sesi\u00f3n de confianza."
}
],
"id": "CVE-2024-41753",
"lastModified": "2025-08-14T01:51:25.910",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
},
"published": "2025-05-03T16:15:19.150",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7232197"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-02-05 12:15
Modified
2025-08-12 16:30
Severity ?
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7182403 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 18.0.0 | |
| ibm | cloud_pak_for_business_automation | 18.0.1 | |
| ibm | cloud_pak_for_business_automation | 18.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.1 | |
| ibm | cloud_pak_for_business_automation | 19.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.3 | |
| ibm | cloud_pak_for_business_automation | 20.0.1 | |
| ibm | cloud_pak_for_business_automation | 20.0.2 | |
| ibm | cloud_pak_for_business_automation | 20.0.3 | |
| ibm | cloud_pak_for_business_automation | 21.0.1 | |
| ibm | cloud_pak_for_business_automation | 21.0.2 | |
| ibm | cloud_pak_for_business_automation | 21.0.3 | |
| ibm | cloud_pak_for_business_automation | 22.0.1 | |
| ibm | cloud_pak_for_business_automation | 22.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation\u00a018.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 y 22.0.2 son vulnerables a ataques de Cross-Site Scripting. Esta vulnerabilidad permite que un usuario autenticado incorpore c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista y puede provocar la divulgaci\u00f3n de credenciales en una sesi\u00f3n de confianza."
}
],
"id": "CVE-2024-52364",
"lastModified": "2025-08-12T16:30:44.777",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
]
},
"published": "2025-02-05T12:15:28.743",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7182403"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-02-05 12:15
Modified
2025-08-12 16:28
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2
is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7182403 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 18.0.0 | |
| ibm | cloud_pak_for_business_automation | 18.0.1 | |
| ibm | cloud_pak_for_business_automation | 18.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.1 | |
| ibm | cloud_pak_for_business_automation | 19.0.2 | |
| ibm | cloud_pak_for_business_automation | 19.0.3 | |
| ibm | cloud_pak_for_business_automation | 20.0.1 | |
| ibm | cloud_pak_for_business_automation | 20.0.2 | |
| ibm | cloud_pak_for_business_automation | 20.0.3 | |
| ibm | cloud_pak_for_business_automation | 21.0.1 | |
| ibm | cloud_pak_for_business_automation | 21.0.2 | |
| ibm | cloud_pak_for_business_automation | 21.0.3 | |
| ibm | cloud_pak_for_business_automation | 22.0.1 | |
| ibm | cloud_pak_for_business_automation | 22.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C27956AA-CCEE-4073-A8D7-D1B9575EE25C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D52711AA-0F11-47E7-8EE8-6B8D65403F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "250AC4D5-1D25-4EEE-B1CA-AA8E104BBF7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation\u00a018.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 \n\nis vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 y 22.0.2 es vulnerable a cross-site scripting almacenado. Esta vulnerabilidad permite a los usuarios autenticados incorporar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista y pudiendo provocar la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza."
}
],
"id": "CVE-2024-52365",
"lastModified": "2025-08-12T16:28:43.040",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-05T12:15:28.917",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7182403"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-05-03 19:15
Modified
2025-08-14 01:53
Severity ?
Summary
IBM Cloud Pak for Business Automation
24.0.0 and 24.0.1 through 24.0.1 IF001
Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7232429 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.0 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 | |
| ibm | cloud_pak_for_business_automation | 24.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE0E647-C352-4AFB-BA14-7E3B6186EDB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EF879B84-21B0-4FD4-AD2E-7F29EBDD218A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "496D1A48-3403-471F-AD07-AEC7E5000AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "AA215EC3-DDFE-494D-862C-35CA30D9BEDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "969ED94C-DB65-482F-B8B8-251B56DE264D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "D1810412-5987-4F53-A81E-096A4F0187B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F68528C5-034B-4B2C-8745-B969B14B52C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "EADE80E3-4E60-4154-A559-93E2325D799A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation\n\n 24.0.0 and 24.0.1 through 24.0.1 IF001 \n\nAuthoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 24.0.0 y 24.0.1 a 24.0.1 IF001 La creaci\u00f3n permite que un usuario autenticado omita la validaci\u00f3n de datos del lado del cliente en una interfaz de usuario de creaci\u00f3n, lo que podr\u00eda provocar una denegaci\u00f3n de servicio."
}
],
"id": "CVE-2025-1838",
"lastModified": "2025-08-14T01:53:13.530",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
},
"published": "2025-05-03T19:15:48.607",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/7232429"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-602"
}
],
"source": "psirt@us.ibm.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-06-27 17:15
Modified
2024-11-21 08:03
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 255587.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | https://https://www.ibm.com/support/pages/node/6998727 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | https://https://www.ibm.com/support/pages/node/7001291 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/pages/node/6998727 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://https://www.ibm.com/support/pages/node/6998727 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://https://www.ibm.com/support/pages/node/7001291 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/6998727 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5D419EF8-4D41-4FBE-A41B-9F9EAF7F72EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12A70646-ADD3-4CF7-A591-8BE96FBEF5A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6CB2C4-800F-487A-B0E5-8A0A9718549D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE2C6F84-C83F-4AE1-B0A7-740568F52C04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8A641D-B7AB-41FA-AFDB-2C8EBDA6A1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5B7FA4-A27C-40CA-AA53-183909D18C13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AF7E2601-47E6-4111-9DE0-C3C01705884A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "AECC2FB4-0D29-45DB-AB55-B6C6C6A8BB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "B8F5E495-92A5-419D-884B-C82D6AA5B56B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "508939AF-58FC-4E12-B4E2-B11865B603F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "C5B419DE-4597-4A33-861D-5530BDA9E679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "00EE653A-0EAD-489B-9610-6BEE3295AAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "06B644E7-7EB2-4AB6-9D30-EA0602373FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "838846CB-8436-40D1-9C3B-FBA2426351E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BA799229-3577-409F-BFCC-0ABA541EA710",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "5EB47B7D-C408-4ED1-9D98-8BF77FFEF8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_0012:*:*:*:*:*:*",
"matchCriteriaId": "02D22CC4-3541-4BAA-8B45-FEB41F2E1697",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "E8859A71-36FD-4E83-B8C6-BEEF772AB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAEF9352-EDCB-4D16-B3F9-11962D3E9F50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "F5C8892F-A803-4E3F-8992-5011B2E73C3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "4890680E-8D82-46DB-9346-3C26D8C9F7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "4F11DDE3-29C4-4CC4-AF73-DF7CCC73D5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "358590C1-6CAF-4FA7-9975-C9DD41242B1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "9C2A88F1-55B3-43A9-8051-71C467A6712F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "E06C0789-2CC4-4D57-87D0-C0FAB9DB1B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "3B207F2D-B5F2-4B0C-863A-AD1620633A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "5E3468FC-CB4C-4EFE-A1ED-46F780ABB703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "D26A78C9-525C-43B3-88FF-9A6AC62A6C7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A8D6EB68-3804-494D-B12A-2E96E31D1B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "21D8DE68-5651-4068-B978-79B28F2DC5D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "BBEA972A-A41E-44C9-8D35-1A991D3384B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "D3009F4E-7157-43D3-B6A0-2531CDE619BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "1DA97C23-9B80-4956-9873-317902A0D804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "1D0B6203-C775-4C5E-BAE9-C956E718F261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "257A7A17-7EDF-4E23-88A6-216BC29EC467",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:*",
"matchCriteriaId": "26FF217B-1BD4-46E5-8023-2B2989FF7868",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:*",
"matchCriteriaId": "C60E58EA-C4D5-4D4D-8C9B-3EC33A7027E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:*",
"matchCriteriaId": "7817670E-5649-42A9-B5F9-7586D7AEB4CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:*",
"matchCriteriaId": "FC7F85E8-8185-418A-B25F-8E64A58177DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:*",
"matchCriteriaId": "37616DCD-C26C-44EA-AA7F-732DC128FFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:*",
"matchCriteriaId": "26CAC076-6FED-49E2-BF33-230F1D1195F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:*",
"matchCriteriaId": "5A88C56C-22CC-4791-BB33-C1494E7F41EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:*",
"matchCriteriaId": "12652B2E-307E-4568-920B-A869914ED650",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:*",
"matchCriteriaId": "8F4E242F-BDF4-4CFE-B808-4A4B7A6FAD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:*",
"matchCriteriaId": "88E736CF-CA6E-400B-9AE3-2C58D2265752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:*",
"matchCriteriaId": "02488B2F-8D6E-4BDC-8DA9-45F5EBC42049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:*",
"matchCriteriaId": "854F4AF8-B712-446E-9DE1-A2496D5E9C1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:*",
"matchCriteriaId": "CF3F1B62-089B-41ED-AD3E-F31F8E967F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:*",
"matchCriteriaId": "ABB843C3-F26D-43A5-AD3E-9D30D00339D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F22E2017-86A6-4CD1-8192-7A5DF0A1D818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "31BC7CBD-C728-481C-AC5F-110FD7799B6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "49793CE0-A419-4937-89B4-B6A8F0E22C0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "E7ABFE27-D890-4AF4-8686-296F4DB90F73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "BE746B2B-EECA-4332-9A24-8EF23BDA1B52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "CEE539C9-6AF2-4B02-8916-2AC7D4A93C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "72743164-5279-4FB6-86EE-EBE5B8CD6D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*",
"matchCriteriaId": "517C5EDE-5104-4E22-B9C6-64DFBA7650C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "7A81368D-744B-4886-96C7-1755A27C0AAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "5B823170-57D5-4329-B41A-6C347982E00B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "AAE375C3-E995-415F-A349-A45998764910",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "A402E881-759D-4B59-985D-4DDA49327147",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 255587."
}
],
"id": "CVE-2023-32339",
"lastModified": "2024-11-21T08:03:08.850",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-06-27T17:15:09.547",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://https://www.ibm.com/support/pages/node/6998727"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://https://www.ibm.com/support/pages/node/7001291"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6998727"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://https://www.ibm.com/support/pages/node/6998727"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://https://www.ibm.com/support/pages/node/7001291"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/pages/node/6998727"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}