CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
32.8%
A denial of service vulnerability has been found in IBM Business Automation Workflow.
CVEID: CVE-2018-1997
DESCRIPTION: IBM Business Automation Workflow and Business Process Manager are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/154774> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
- IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2
- IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03
- IBM Business Process Manager Advanced V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06
- IBM Business Process Manager Advanced V8.5.6.0 through V8.5.6.0 Cumulative Fix 2
-IBM Business Process Manager Advanced V8.5.5.0
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR JR60499 as soon as practical:
For IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2
ยท Upgrade to minimal cumulative fix levels as required by iFix and then apply iFix JR60499
Note that Business Automation Workflow 18.0.0.0 is a software bundle that includes IBM Business Process Manager V8.6.0.0 CF 2018.03. To download the fix for IBM Business Automation Workflow 18.0.0.0, download the fix labeled โ8.6.0.201803-WS-BPM-IFJR60499โ.
--ORโ
ยท Apply cumulative fix Business Automation Workflow V19.0.0.1
For IBM Business Process Manager V8.6.0.0 through V8.6.0.0 CF 2018.03
ยท Upgrade to minimal cumulative fix levels as required by iFix and then apply iFix JR60499
Note that Business Automation Workflow 18.0.0.0 is a software bundle that includes IBM Business Process Manager V8.6.0.0 CF 2018.03. To download the fix for IBM Business Process Manager V8.6.0.0 CF 2018.03, download the fix labeled โ8.6.0.201803-WS-BPM-IFJR60499โ.
--ORโ
ยท Upgrade to Business Automation Workflow V19.0.0.1
For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2017.06
ยท Apply Cumulative Fix 2017.06 and then apply iFix JR60499
--ORโ
ยท Upgrade to Business Automation Workflow V19.0.0.1
For IBM BPM V8.5.6.0 through V8.5.6.0 CF 2
ยท Apply CF2 and then apply iFix JR60499
--ORโ
ยท Upgrade to Business Automation Workflow V19.0.0.1
For IBM BPM V8.5.5.
ยท Apply iFix JR60499
--ORโ
ยท Upgrade to Business Automation Workflow V19.0.0.1
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | business_automation_workflow | 18.0.0.0 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 18.0.0.1 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 18.0.0.2 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:* |
ibm | business_process_manager | 8.6.0. | cpe:2.3:a:ibm:business_process_manager:8.6.0.:*:*:*:*:*:*:* |
ibm | business_process_manager | 201803 | cpe:2.3:a:ibm:business_process_manager:201803:*:*:*:*:*:*:* |
ibm | business_process_manager | 201712 | cpe:2.3:a:ibm:business_process_manager:201712:*:*:*:*:*:*:* |
ibm | business_process_manager | 8.6 | cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:*:*:*:* |
ibm | business_process_manager | 8.5.7. | cpe:2.3:a:ibm:business_process_manager:8.5.7.:*:*:*:advanced:*:*:* |
ibm | business_process_manager | 201706 | cpe:2.3:a:ibm:business_process_manager:201706:*:*:*:advanced:*:*:* |
ibm | business_process_manager | 201703 | cpe:2.3:a:ibm:business_process_manager:201703:*:*:*:advanced:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
32.8%