Lucene search

K

IBMAAB88F89959F5720320E5ABE697DE22E4780C146003AC9D23F70886B6978A633

HistorySep 14, 2022 - 3:02 p.m.

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Digital Business Automation Workflow family products (CVE-2019-4663)

2022-09-1415:02:20

www.ibm.com

18

ibm

websphere application server

liberty

security vulnerability

cve-2019-4663

business automation workflow

business process manager

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.6%

Summary

WebSphere Application Server Liberty is shipped as a component of IBM Business Automation Workflow and IBM Business Process Manager Process Federation Server (since 8.5.6) and User Management Service (since 18.0.0.1). Information about a security vulnerability affecting IBM WebSphere Application Server Liberty have been published in a security bulletin.

Vulnerability Details

Refer to the security bulletins(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Business Automation Workflow	V19.0
V18.0
IBM Business Process Manager	8.6
8.5

Note that Cumulative Fixes cannot automatically install interim fixes for the base Application Server. It is important to follow the complete installation instructions and manually ensure that recommended security fixes are installed.

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

Please consult the security bulletin: WebSphere Application Server Liberty is vulnerable to Cross-site Scripting (CVE-2019-4663) for vulnerability details and information about fixes.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmbusiness_process_managerMatch8.6advanced

OR

ibmbusiness_process_managerMatch8.5.7.advanced

OR

ibmbusiness_process_managerMatch201706advanced

OR

ibmbusiness_process_managerMatch8.5.7.advanced

OR

ibmbusiness_process_managerMatch201703advanced

OR

ibmbusiness_process_managerMatch8.5.7.advanced

OR

ibmbusiness_process_managerMatch201612advanced

OR

ibmbusiness_process_managerMatch8.5.7.advanced

OR

ibmbusiness_process_managerMatch201609advanced

OR

ibmbusiness_process_managerMatch8.5.7.advanced

OR

ibmbusiness_process_managerMatch201606advanced

OR

ibmbusiness_process_managerMatch8.5.7advanced

OR

ibmbusiness_process_managerMatch8.5.6.2advanced

OR

ibmbusiness_process_managerMatch8.5.6.1advanced

OR

ibmbusiness_process_managerMatch8.5.6advanced

OR

ibmbusiness_process_managerMatch8.6.0.express

OR

ibmbusiness_process_managerMatch201803express

OR

ibmbusiness_process_managerMatch8.6.0.express

OR

ibmbusiness_process_managerMatch201712express

OR

ibmbusiness_process_managerMatch8.6express

OR

ibmbusiness_process_managerMatch8.5.7.express

OR

ibmbusiness_process_managerMatch201706express

OR

ibmbusiness_process_managerMatch8.5.7.express

OR

ibmbusiness_process_managerMatch201703express

OR

ibmbusiness_process_managerMatch8.5.7.express

OR

ibmbusiness_process_managerMatch201612express

OR

ibmbusiness_process_managerMatch8.5.7.express

OR

ibmbusiness_process_managerMatch201609express

OR

ibmbusiness_process_managerMatch8.5.7.express

OR

ibmbusiness_process_managerMatch201606express

OR

ibmbusiness_process_managerMatch8.5.7express

OR

ibmbusiness_process_managerMatch8.5.6.2express

OR

ibmbusiness_process_managerMatch8.5.6.1express

OR

ibmbusiness_process_managerMatch8.5.6express

OR

ibmbusiness_process_managerMatch8.6.0.

OR

ibmbusiness_process_managerMatch201803

OR

ibmbusiness_process_managerMatch8.6.0.

OR

ibmbusiness_process_managerMatch201712

OR

ibmbusiness_process_managerMatch8.6

OR

ibmbusiness_process_managerMatch8.5.7.standard

OR

ibmbusiness_process_managerMatch201706standard

OR

ibmbusiness_process_managerMatch8.5.7.standard

OR

ibmbusiness_process_managerMatch201703standard

OR

ibmbusiness_process_managerMatch8.5.7.standard

OR

ibmbusiness_process_managerMatch201612standard

OR

ibmbusiness_process_managerMatch8.5.7.standard

OR

ibmbusiness_process_managerMatch201609standard

OR

ibmbusiness_process_managerMatch8.5.7.standard

OR

ibmbusiness_process_managerMatch201606standard

OR

ibmbusiness_process_managerMatch8.5.7standard

OR

ibmbusiness_process_managerMatch8.5.6.2standard

OR

ibmbusiness_process_managerMatch8.5.6.1standard

OR

ibmbusiness_process_managerMatch8.5.6standard

OR

ibmbusiness_automation_workflowMatch18.0.0.0

OR

ibmbusiness_automation_workflowMatch18.0.0.1

OR

ibmbusiness_automation_workflowMatch18.0.0.2

OR

ibmbusiness_automation_workflowMatch19.0.0.1

OR

ibmbusiness_automation_workflowMatch19.0.0.2

OR

ibmbusiness_automation_workflowMatch19.0.0.3

VendorProductVersionCPE
ibmbusiness_process_manager8.6cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:advanced:*:*:*
ibmbusiness_process_manager8.5.7.cpe:2.3:a:ibm:business_process_manager:8.5.7.:*:*:*:advanced:*:*:*
ibmbusiness_process_manager201706cpe:2.3:a:ibm:business_process_manager:201706:*:*:*:advanced:*:*:*
ibmbusiness_process_manager201703cpe:2.3:a:ibm:business_process_manager:201703:*:*:*:advanced:*:*:*
ibmbusiness_process_manager201612cpe:2.3:a:ibm:business_process_manager:201612:*:*:*:advanced:*:*:*
ibmbusiness_process_manager201609cpe:2.3:a:ibm:business_process_manager:201609:*:*:*:advanced:*:*:*
ibmbusiness_process_manager201606cpe:2.3:a:ibm:business_process_manager:201606:*:*:*:advanced:*:*:*
ibmbusiness_process_manager8.5.7cpe:2.3:a:ibm:business_process_manager:8.5.7:*:*:*:advanced:*:*:*
ibmbusiness_process_manager8.5.6.2cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:advanced:*:*:*
ibmbusiness_process_manager8.5.6.1cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:advanced:*:*:*

Rows per page:

1-10 of 451

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.6%

Related for AAB88F89959F5720320E5ABE697DE22E4780C146003AC9D23F70886B6978A633

ibm22 cvelist1 cve1 nvd1 prion1 redhat1