Lucene search
IBM126D2D451669D7E4CBC1C9F85CD017AA0BC9F65E36B01792100EFF03EDA0EDEBHistoryNov 16, 2022 - 8:59 p.m.
Security Bulletin: Cross-Site Scripting vulnerability affect IBM Business Automation Workflow - CVE-2022-38390
2022-11-1620:59:20
www.ibm.com
22
ibm business automation workflow
cross-site scripting
vulnerability
cve-2022-38390
fix
version
apar dt143426
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
19.6%
Summary
Workflow Center in IBM Business Automation Workflow is vulnerable to a Cross-Site Scripting attack.
Vulnerability Details
CVEID:CVE-2022-38390
**DESCRIPTION:**IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/233978 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) | Status |
|---|---|---|
| IBM Business Automation Workflow containers | V22.0.1 - V22.0.1 all fixes | |
| V21.0.3 - V21.0.3 all fixes | ||
| V21.0.2 all fixes | ||
| V20.0.0.2 all fixes | ||
| V20.0.0.1 all fixes | not affected | |
| IBM Business Automation Workflow traditional | V22.0.1 | |
| V21.0.1 - V21.0.3.1 | ||
| V20.0.0.1 - V20.0.0.2 | ||
| V19.0.0.1 - V19.0.0.3 | ||
| V18.0.0.0 - V18.0.0.2 | affected |
For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.
Remediation/Fixes
| The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT143426 as soon as practical. Affected Product(s) | Version(s) | Remediation / Fix |
|---|---|---|
| IBM Business Automation Workflow traditional | V22.0.1 | Apply DT143426 |
| IBM Business Automation Workflow traditional | V21.0.3 | Apply DT143426 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT143426 | ||
| IBM Business Automation Workflow traditional | V21.0.2 | Upgrade to IBM Business Automation Workflow 21.0.3 and apply DT143426 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT143426 | ||
| IBM Business Automation Workflow traditional | V20.0.0.2 | Apply DT143426 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT143426 | ||
| IBM Business Automation Workflow traditional | V20.0.0.1 | Upgrade to IBM Business Automation Workflow v20.0.0.2 and apply DT143426 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT143426 | ||
| IBM Business Automation Workflow traditional | V19.0.0.3 | Apply DT143426 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT143426 | ||
| IBM Business Automation Workflow traditional | V19.0.0.1 - V19.0.0.2 | Upgrade to IBM Business Automation Workflow 19.0.0.3 and apply DT143426 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT143426 |
Workarounds and Mitigations
None
Affected configurations
Node
ibmbusiness_process_managerMatch8.6advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201706advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201703advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201612advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201609advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201606advanced
ORibmbusiness_process_managerMatch8.5.7advanced
ORibmbusiness_process_managerMatch8.5.6.2advanced
ORibmbusiness_process_managerMatch8.5.6.1advanced
ORibmbusiness_process_managerMatch8.5.6advanced
ORibmbusiness_process_managerMatch8.5.5advanced
ORibmbusiness_process_managerMatch8.5.0.2advanced
ORibmbusiness_process_managerMatch8.5.0.1advanced
ORibmbusiness_process_managerMatch8.5advanced
ORibmbusiness_process_managerMatch8.6standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201706standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201703standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201612standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201609standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201606standard
ORibmbusiness_process_managerMatch8.5.7standard
ORibmbusiness_process_managerMatch8.5.6.2standard
ORibmbusiness_process_managerMatch8.5.6.1standard
ORibmbusiness_process_managerMatch8.5.6standard
ORibmbusiness_process_managerMatch8.5.5standard
ORibmbusiness_process_managerMatch8.5.0.2standard
ORibmbusiness_process_managerMatch8.5.0.1standard
ORibmbusiness_process_managerMatch8.5standard
ORibmbusiness_automation_workflowMatch18.0.0.0
ORibmbusiness_automation_workflowMatch18.0.0.1
ORibmbusiness_automation_workflowMatch18.0.0.2
ORibmbusiness_automation_workflowMatch19.0.0.1
ORibmbusiness_automation_workflowMatch19.0.0.2
ORibmbusiness_automation_workflowMatch19.0.0.3
ORibmbusiness_automation_workflowMatch20.0.0.1
ORibmbusiness_automation_workflowMatch20.0.0.2
ORibmbusiness_automation_workflowMatch21.0.2
ORibmbusiness_automation_workflowMatch21.0.3
ORibmbusiness_automation_workflowMatch22.0.1
ORibmbusiness_process_managerMatch8.6express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201706express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201703express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201612express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201609express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201606express
ORibmbusiness_process_managerMatch8.5.7express
ORibmbusiness_process_managerMatch8.5.6.2express
ORibmbusiness_process_managerMatch8.5.6.1express
ORibmbusiness_process_managerMatch8.5.6express
ORibmbusiness_process_managerMatch8.5.5express
ORibmbusiness_process_managerMatch8.5.0.2express
ORibmbusiness_process_managerMatch8.5.0.1express
ORibmbusiness_process_managerMatch8.5express
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | business_process_manager | 8.6 | cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 8.5.7. | cpe:2.3:a:ibm:business_process_manager:8.5.7.:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 201706 | cpe:2.3:a:ibm:business_process_manager:201706:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 201703 | cpe:2.3:a:ibm:business_process_manager:201703:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 201612 | cpe:2.3:a:ibm:business_process_manager:201612:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 201609 | cpe:2.3:a:ibm:business_process_manager:201609:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 201606 | cpe:2.3:a:ibm:business_process_manager:201606:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 8.5.7 | cpe:2.3:a:ibm:business_process_manager:8.5.7:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 8.5.6.2 | cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:advanced:*:*:* |
| ibm | business_process_manager | 8.5.6.1 | cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:advanced:*:*:* |
Related
nvd
nvd
CVE-2022-38390
2022-11-17 17:15:10
cve
cve
CVE-2022-38390
2022-11-17 17:15:10
prion
prion
Cross site scripting
2022-11-17 17:15:00
cvelist
cvelist
CVE-2022-38390
2022-11-17 16:48:11
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
19.6%
Related for 126D2D451669D7E4CBC1C9F85CD017AA0BC9F65E36B01792100EFF03EDA0EDEB