Lucene search

IbmCVE-2020-4698

HistorySep 08, 2020 - 3:15 p.m.

CVE-2020-4698

2020-09-0815:15:12

CWE-79

ibm

web.nvd.nist.gov

ibm

business process manager

automation workflow

vulnerability

stored xss

credentials disclosure

web ui

security advisory

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

19.6%

JSON

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841.

Affected configurations

Nvd

Vulners

Node

ibmbusiness_automation_workflowMatch18.0.0.0

ibmbusiness_automation_workflowMatch18.0.0.1

ibmbusiness_automation_workflowMatch18.0.0.2

ibmbusiness_automation_workflowMatch19.0.0.0

ibmbusiness_automation_workflowMatch19.0.0.1

ibmbusiness_automation_workflowMatch19.0.0.2

ibmbusiness_automation_workflowMatch19.0.0.3

ibmbusiness_automation_workflowMatch20.0.0.1

Node

ibmbusiness_process_managerMatch8.5.0.0express

ibmbusiness_process_managerMatch8.5.0.0standard

ibmbusiness_process_managerMatch8.5.0.1express

ibmbusiness_process_managerMatch8.5.0.1standard

ibmbusiness_process_managerMatch8.5.0.2express

ibmbusiness_process_managerMatch8.5.0.2standard

ibmbusiness_process_managerMatch8.5.5.0express

ibmbusiness_process_managerMatch8.5.5.0standard

ibmbusiness_process_managerMatch8.5.6.0-express

ibmbusiness_process_managerMatch8.5.6.0-standard

ibmbusiness_process_managerMatch8.5.6.1express

ibmbusiness_process_managerMatch8.5.6.1standard

ibmbusiness_process_managerMatch8.5.6.2express

ibmbusiness_process_managerMatch8.5.6.2standard

ibmbusiness_process_managerMatch8.5.7.0express

ibmbusiness_process_managerMatch8.5.7.0standard

ibmbusiness_process_managerMatch8.5.7.0cf201606express

ibmbusiness_process_managerMatch8.5.7.0cf201606standard

ibmbusiness_process_managerMatch8.5.7.0cf201609express

ibmbusiness_process_managerMatch8.5.7.0cf201609standard

ibmbusiness_process_managerMatch8.5.7.0cf201612express

ibmbusiness_process_managerMatch8.5.7.0cf201612standard

ibmbusiness_process_managerMatch8.5.7.0cf201703express

ibmbusiness_process_managerMatch8.5.7.0cf201703standard

ibmbusiness_process_managerMatch8.5.7.0cf201706express

ibmbusiness_process_managerMatch8.5.7.0cf201706standard

ibmbusiness_process_managerMatch8.6.0.0-express

ibmbusiness_process_managerMatch8.6.0.0-standard

VendorProductVersionCPE
ibmbusiness_automation_workflow18.0.0.0cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.1cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.2cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.0cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.1cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.2cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.3cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.1cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
ibmbusiness_process_manager8.5.0.0cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*
ibmbusiness_process_manager8.5.0.0cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*

Vendor	Product	Version	CPE
ibm	business_automation_workflow	18.0.0.0	cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:::::::*
ibm	business_automation_workflow	18.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:::::::*
ibm	business_automation_workflow	18.0.0.2	cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:::::::*
ibm	business_automation_workflow	19.0.0.0	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:::::::*
ibm	business_automation_workflow	19.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:::::::*
ibm	business_automation_workflow	19.0.0.2	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:::::::*
ibm	business_automation_workflow	19.0.0.3	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:::::::*
ibm	business_automation_workflow	20.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:::::::*
ibm	business_process_manager	8.5.0.0	cpe:2.3:a:ibm:business_process_manager:8.5.0.0::::express:::
ibm	business_process_manager	8.5.0.0	cpe:2.3:a:ibm:business_process_manager:8.5.0.0::::standard:::

Rows per page:

1-10 of 361

CNA Affected

[
  {
    "product": "Business Process Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.5"
      },
      {
        "status": "affected",
        "version": "8.6"
      }
    ]
  },
  {
    "product": "Business Automation Workflow",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "18.0"
      },
      {
        "status": "affected",
        "version": "19.0"
      },
      {
        "status": "affected",
        "version": "20.0"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/186841

www.ibm.com/support/pages/node/6326825

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

19.6%

JSON

Related for CVE-2020-4698