Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM71AE0D5024D39B08B24A7182D24ED9015A9DA203851A438D5EF30F80E1A05C50
HistorySep 14, 2022 - 3:28 p.m.

Security Bulletin: A CVE-2021-37714 vulnerability in jsoup affects IBM Process Designer in IBM Business Automation Workflow and IBM Business Process Manager

2022-09-1415:28:14
www.ibm.com
52
ibm process designer
ibm business automation workflow
ibm business process manager
jsoup
html parser
xml parser
denial of service
vulnerability
ibm bpm process designer
fix
ibm business automation workflow 19.0.0.3
ibm business automation workflow 20.0.0.2
ibm business automation workflow 21.0.0.2
ibm business process manager 8.6.0.0 cf2018.03
ibm business process manager advanced 8.5.7 cf2017.06
ibm business process manager standard 8.5.7 cf2017.06
ibm business process manager express 8.5.7 cf2017.06

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.009

Percentile

82.8%

JSON

Summary

A vulnerabilitiy exists in jsoup used by the desktop version of IBM Process Designer. IBM Process Designer has addressed the applicable CVE.

Vulnerability Details

CVEID:CVE-2021-37714
**DESCRIPTION:**jsoup is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the HTML and XML parser to get stuck, timeout, or throw unchecked exceptions resulting in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/207858 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Business Automation Workflow 18.0.0.0 - 21.0.2
IBM BPM Process Designer 8.6-8.6 CF2018.03
IBM BPM Process Designer 8.5.0-8.5.7 2017.06

Remediation/Fixes

Install interim fix JR64213 for your version:

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmbusiness_process_managerMatch8.6.0.0
OR
ibmbusiness_process_managerMatch2018.03
OR
ibmbusiness_process_managerMatch8.6advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch2017.06advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch2017.03advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch2016.12advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch2016.09advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch2016.06advanced
OR
ibmbusiness_process_managerMatch8.5.7advanced
OR
ibmbusiness_process_managerMatch8.5.6.2advanced
OR
ibmbusiness_process_managerMatch8.5.6.1advanced
OR
ibmbusiness_process_managerMatch8.5.6advanced
OR
ibmbusiness_process_managerMatch8.5.5advanced
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch2017.06standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch2017.03standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch2016.12standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch2016.09standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch2016.06standard
OR
ibmbusiness_process_managerMatch8.5.7standard
OR
ibmbusiness_process_managerMatch8.5.6.2standard
OR
ibmbusiness_process_managerMatch8.5.6.1standard
OR
ibmbusiness_process_managerMatch8.5.6standard
OR
ibmbusiness_process_managerMatch8.5.5standard
OR
ibmbusiness_process_managerMatch8.6express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch2017.06express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch2017.03express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch2016.12express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch2016.09express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch2016.06express
OR
ibmbusiness_process_managerMatch8.5.7express
OR
ibmbusiness_process_managerMatch8.5.6.2express
OR
ibmbusiness_process_managerMatch8.5.6.1express
OR
ibmbusiness_process_managerMatch8.5.6express
OR
ibmbusiness_process_managerMatch8.5.5express
OR
ibmbusiness_automation_workflowMatch18.0.0.1
OR
ibmbusiness_automation_workflowMatch18.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.1
OR
ibmbusiness_automation_workflowMatch19.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.3
OR
ibmbusiness_automation_workflowMatch20.0.0.1
OR
ibmbusiness_automation_workflowMatch20.0.0.2
OR
ibmbusiness_automation_workflowMatch21.0.1
OR
ibmbusiness_automation_workflowMatch21.0.2
VendorProductVersionCPE
ibmbusiness_process_manager8.6.0.0cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*
ibmbusiness_process_manager2018.03cpe:2.3:a:ibm:business_process_manager:2018.03:*:*:*:*:*:*:*
ibmbusiness_process_manager8.6cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:advanced:*:*:*
ibmbusiness_process_manager8.5.7.cpe:2.3:a:ibm:business_process_manager:8.5.7.:*:*:*:advanced:*:*:*
ibmbusiness_process_manager2017.06cpe:2.3:a:ibm:business_process_manager:2017.06:*:*:*:advanced:*:*:*
ibmbusiness_process_manager2017.03cpe:2.3:a:ibm:business_process_manager:2017.03:*:*:*:advanced:*:*:*
ibmbusiness_process_manager2016.12cpe:2.3:a:ibm:business_process_manager:2016.12:*:*:*:advanced:*:*:*
ibmbusiness_process_manager2016.09cpe:2.3:a:ibm:business_process_manager:2016.09:*:*:*:advanced:*:*:*
ibmbusiness_process_manager2016.06cpe:2.3:a:ibm:business_process_manager:2016.06:*:*:*:advanced:*:*:*
ibmbusiness_process_manager8.5.7cpe:2.3:a:ibm:business_process_manager:8.5.7:*:*:*:advanced:*:*:*
Rows per page:
1-10 of 461

Related

cvelist 1
prion 1
osv 4
nessus 13
ibm 9
redhatcve 1
atlassian 1
cve 1
debiancve 1
openvas 2
ubuntucve 1
nvd 1
cbl_mariner 1
suse 1
veracode 1
vaadin 1
github 1
redhat 14
oracle 4
cvelist
cvelist
CVE-2021-37714 Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
2021-08-18 15:10:11
prion
prion
Input validation
2021-08-18 15:15:00
osv
osv
Uncaught Exception in jsoup
2021-08-23 19:42:38
jsoup-1.14.2-1.2 on GA media
2024-06-15 00:00:00
CVE-2021-37714
2021-08-18 15:15:08
nessus
nessus
SUSE SLED15 / SLES15 Security Update : jsoup, jsr-305 (SUSE-SU-2022:1265-1)
2022-04-21 00:00:00
RHEL 7 : jsoup (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 8 : jsoup (Unpatched Vulnerability)
2024-06-03 00:00:00
ibm
ibm
Security Bulletin: Vulnerability in jsoup may affect Cúram Social Program Management (CVE-2021-37714)
2021-11-25 16:13:13
Security Bulletin: IBM Security Guardium is affected by a jsoup vulnerability (CVE-2021-37714)
2022-11-08 20:07:11
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in jsoup
2021-10-01 06:23:13
redhatcve
redhatcve
CVE-2021-37714
2021-08-18 17:35:05
atlassian
atlassian
DoS (Denial of Service) org.jsoup:jsoup in Jira Software Data Center and Server
2023-11-12 13:45:30
cve
cve
CVE-2021-37714
2021-08-18 15:15:08
debiancve
debiancve
CVE-2021-37714
2021-08-18 15:15:08
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2022:1265-1)
2022-04-20 00:00:00
openSUSE: Security Advisory for jsoup, (SUSE-SU-2022:1265-1)
2022-05-17 00:00:00
ubuntucve
ubuntucve
CVE-2021-37714
2021-08-18 00:00:00
nvd
nvd
CVE-2021-37714
2021-08-18 15:15:08
cbl_mariner
cbl_mariner
CVE-2021-37714 affecting package jsoup 1.11.3-3
2024-10-01 09:12:12
suse
suse
Security update for jsoup, jsr-305 (important)
2022-04-19 00:00:00
veracode
veracode
Denial Of Service
2021-08-19 02:33:54
vaadin
vaadin
Denial of service in third-party component in Vaadin 7 and 8
2021-10-27 00:00:00
github
github
Uncaught Exception in jsoup
2021-08-23 19:42:38
redhat
redhat
(RHSA-2021:4676) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
2021-11-15 16:54:28
(RHSA-2021:4677) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
2021-11-15 16:54:31
(RHSA-2021:5149) Moderate: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6
2021-12-15 14:24:37
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
Oracle Critical Patch Update Advisory - January 2022
2022-01-18 00:00:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.009

Percentile

82.8%

JSON
Related for 71AE0D5024D39B08B24A7182D24ED9015A9DA203851A438D5EF30F80E1A05C50
cvelist1prion1osv4nessus13ibm9redhatcve1atlassian1cve1debiancve1openvas2ubuntucve1nvd1cbl_mariner1suse1veracode1vaadin1github1redhat14oracle4