Lucene search

IBM70F109432F5DE19D8E4EA2DEB10E9C0856EEB303EEAEC5B63C2733984DD3F889

HistoryMay 27, 2024 - 6:46 a.m.

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2024-28793

2024-05-2706:46:07

www.ibm.com

ibm engineering workflow management

ewm

team concert git plugin

vulnerability

stored cross-site scripting

jenkins plugin

7.0.2

7.0.3

credentials disclosure

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Summary

Vulnerability CVE-2024-28793 affects the Team Concert Git plugin of IBM Engineering Workflow Management (EWM).

Vulnerability Details

CVEID:CVE-2024-28793
**DESCRIPTION:**IBM Engineering Workflow Management is vulnerable to stored cross-site scripting. Under certain configurations, this vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286830 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
EWM	7.0.2
EWM	7.0.3

Remediation/Fixes

The fix is available in Team Concert Git Jenkins plugin version 2.0.5 which is applicable to EWM 7.0.2 and 7.0.3

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmengineering_workflow_managementMatch7.0.2

ibmengineering_workflow_managementMatch7.0.3

VendorProductVersionCPE
ibmengineering_workflow_management7.0.2cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:*:*:*:*:*:*:*
ibmengineering_workflow_management7.0.3cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	engineering_workflow_management	7.0.2	cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:::::::*
ibm	engineering_workflow_management	7.0.3	cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:::::::*

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for 70F109432F5DE19D8E4EA2DEB10E9C0856EEB303EEAEC5B63C2733984DD3F889