CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
99.6%
In addition to many updates of operating system level packages, the following security vulnerability is addressed with IBM Cloud Pak for Business Automation 21.0.3-IF019 and 22.0.2-IF003.
CVEID:CVE-2023-24998
**DESCRIPTION:**Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted request with series of uploads, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/247895 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2023-24957
**DESCRIPTION:**IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/246115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVEID:CVE-2022-24999
**DESCRIPTION:**Express.js Express is vulnerable to a denial of service, caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a proto or constructor payload, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240815 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2022-25901
**DESCRIPTION:**Node.js cookiejar module is vulnerable to a denial of service, caused by an insecure regular expression in the Cookie.parse function. A remote attacker could exploit this vulnerability to cause a regular expression denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245045 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID:CVE-2022-39353
**DESCRIPTION:**Node.js xmldom module could allow a remote attacker to bypass security restrictions, caused by the use of multiple top level elements. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authentication and obtain administrative access.
CVSS Base score: 9.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239426 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)
CVEID:CVE-2023-25194
**DESCRIPTION:**Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization when configuring the connector via the Kafka Connect REST API. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/246698 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
**IBM X-Force ID:**177835
**DESCRIPTION:**Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker could exploit this vulnerability using a method call to obtain sensitive information.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177835 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Product(s) | Version(s) | Status |
---|---|---|
IBM Cloud Pak for Business Automation | V22.0.2 - V22.0.2-IF002 | affected |
IBM Cloud Pak for Business Automation | V21.0.3 - V21.0.3-IF018 | affected |
IBM Cloud Pak for Business Automation | V22.0.1 - V22.0.1-IF006 and later fixes | |
V21.0.2 - V21.0.2-IF012 and later fixes | ||
V21.0.1 - V21.0.1-IF007 and later fixes | ||
V20.0.1 - V20.0.3 and later fixes | ||
V19.0.1 - V19.0.3 and later fixes | ||
V18.0.0 - V18.0.2 and later fixes | affected |
Any open source library may be included in one or more sub-components of IBM Cloud Pak for Business Automation. Open source updates are not always synchronized across all components. The CVE in this bulletin are specifically addressed by
CVE ID | Addressed in component |
---|---|
CVE-2023-24998 | Business Automation Navigator, Operational Decision Management |
CVE-2023-24957 | Business Automation Workflow, Business Automation Studio |
CVE-2022-24999 | Automation Decision Services |
CVE-2022-25901 | Automation Decision Services |
CVE-2022-39353 | Business Automation Application |
177835 | Automation Decision Services |
CVE-2023-25194 | Business Automation Workflow |
Affected Product(s) | Version(s) | Remediation / Fix |
---|---|---|
IBM Cloud Pak for Business Automation | V22.0.2 - V22.0.2-IF002 | Apply security fix 22.0.2-IF003 |
IBM Cloud Pak for Business Automation | V21.0.3 - V21.0.3-IF018 | Apply security fix 21.0.3-IF019 or upgrade to 22.0.2-IF003 |
IBM Cloud Pak for Business Automation | V21.0.1 - V21.0.1-IF008 | |
V20.0.1 - V20.0.3 | ||
V19.0.1 - V19.0.3 | ||
V18.0.0 - V18.0.2 | Upgrade to 21.0.3-IF019 or 22.0.2-IF003 |
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | cloud_pak_for_automation | 18.0.0 | cpe:2.3:a:ibm:cloud_pak_for_automation:18.0.0:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 18.0.1 | cpe:2.3:a:ibm:cloud_pak_for_automation:18.0.1:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 18.0.2 | cpe:2.3:a:ibm:cloud_pak_for_automation:18.0.2:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 19.0.1 | cpe:2.3:a:ibm:cloud_pak_for_automation:19.0.1:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 19.0.2 | cpe:2.3:a:ibm:cloud_pak_for_automation:19.0.2:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 19.0.3 | cpe:2.3:a:ibm:cloud_pak_for_automation:19.0.3:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 20.0.1 | cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.1:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 20.0.2 | cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.2:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 20.0.3 | cpe:2.3:a:ibm:cloud_pak_for_automation:20.0.3:*:*:*:*:*:*:* |
ibm | cloud_pak_for_automation | 21.0.1 | cpe:2.3:a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
99.6%