CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
EPSS
Percentile
52.4%
An XML External Entity Injection vulnerability in IBM Business Automation Workflow and IBM BPM has been found.
CVEID: CVE-2019-4424 DESCRIPTION: IBM Business Automation Workflow is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Base Score: 7.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/162770> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
- IBM Business Automation Workflow V18.0.0.0 through V19.0.0.2
- IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03
- IBM Business Process Manager V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06
- IBM Business Process Manager V8.5.6.0 through V8.5.6.0 CF2
- IBM Business Process Manager V8.5.5.0
- IBM Business Process Manager V8.5.0.0 through V8.5.0.2
- IBM Business Process Manager V8.0.0.0 through V8.0.1.3
- IBM Business Process Manager V7.5.0.0 through V7.5.1.2
Install interim fix JR61232 as appropriate for your current IBM Business Automation Workflow or IBM BPM version.
For IBM Business Automation Workflow V18.0.0.0 through V19.0.0.2
ยท Upgrade to at least IBM Business Automation Workflow V18.0.0.1 as required by iFix and then apply iFix JR61232
--ORโ
ยท Apply cumulative fix IBM Business Automation Workflow V19.0.0.3
For IBM BPM V8.6.0.0 through V8.6.0.0 CF 2018.03
ยท Upgrade to at least IBM BPM V8.6.0.0 CF 2017.12 as required by iFix and then apply iFix JR61232
For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2017.06
ยท Apply Cumulative Fix 2017.06 and then apply iFix JR61232
For IBM BPM V8.5.6.0 through V8.5.6.0 CF2
ยท Apply CF2 as required by iFix and then apply iFix JR61232
For IBM BPM V8.5.5.0
ยท Apply iFix JR61232
For IBM BPM V8.5.0.0 through V8.5.0.2
ยท Install Fix Pack 2 as required by iFix and then apply iFix JR61232
For IBM BPM V8.0.0.0 through V8.0.1.3
ยท Upgrade to minimal Refresh Pack 1, install Fix Pack 3 as required by iFix and then apply iFix JR61232
For IBM BPM V7.0.0.0 through V7.5.1.2
ยท Upgrade to minimal Refresh Pack 1, install Fix Pack 2 as required by iFix and then apply iFix JR61232
As IBM Business Process Manager V7.5 and V8.0 are out of general support, customers with a support extension contract can contact IBM support to request the fix.
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | business_automation_workflow | 18.0.0.0 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 18.0.0.1 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 18.0.0.2 | cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 19.0.0.1 | cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:* |
ibm | business_automation_workflow | 19.0.0.2 | cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:* |
ibm | business_process_manager | 8.6.0. | cpe:2.3:a:ibm:business_process_manager:8.6.0.:*:*:*:*:*:*:* |
ibm | business_process_manager | 201803 | cpe:2.3:a:ibm:business_process_manager:201803:*:*:*:*:*:*:* |
ibm | business_process_manager | 201712 | cpe:2.3:a:ibm:business_process_manager:201712:*:*:*:*:*:*:* |
ibm | business_process_manager | 8.6 | cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:*:*:*:* |
ibm | business_process_manager | 8.5.7. | cpe:2.3:a:ibm:business_process_manager:8.5.7.:*:*:*:advanced:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
EPSS
Percentile
52.4%