CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
31.4%
There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 8, which is used by the desktop version of IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow. IBM Process Designer has addressed the applicable CVEs.
CVEID:CVE-2023-22081
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK related to the JSSE component could allow a remote attacker to cause no confidentiality impact, no integrity impact, and low availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268929 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID:CVE-2023-22067
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE related to the CORBA component could allow a remote attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268928 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2023-5676
**DESCRIPTION:**Eclipse OpenJ9 is vulnerable to a denial of service, caused by a flaw when a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause an infinite busy hang on a spinlock or a segmentation fault.
CVSS Base score: 4.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/271615 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
IBM Process Designer 8.5.7 is shipped with the following versions of IBM Business Automation Workflow:
Affected Product(s) | Version(s) |
---|---|
IBM Business Automation Workflow | 20.0.0.2 - 23.0.1 |
IBM strongly recommends addressing the vulnerabilities now.
IBM Process Designer Version(s) | IBM Business Automation Workflow Version(s) | Remediation/Fix/Instructions |
---|---|---|
8.5.7 | 21.0.3 |
Download interim fix DT247268 and follow instructions in the readme file or download and apply IBM Business Automation Workflow cumulative fix 23.0.2 that includes DT247268 fix.
8.5.7| 20.0.0.2 - 23.0.1| Download and apply IBM Business Automation Workflow cumulative fix 23.0.2 that includes DT247268 fix.
IBM Process Designer is shipped with IBM Business Automation Workflow.
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | business_automation_workflow | 18.0.0.1 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 18.0.0.2 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 19.0.0.1 | cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 19.0.0.2 | cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 19.0.0.3 | cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 20.0.0.1 | cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 20.0.0.2 | cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 21.0.1 | cpe:2.3:a:ibm:business_automation_workflow:21.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 21.0.2 | cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 21.0.3 | cpe:2.3:a:ibm:business_automation_workflow:21.0.3:*:*:*:*:*:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
31.4%