Lucene search

IBMC6DE009F4833F1CAFB1ACC6E422D6633F7BD89D7D3ACBD99D58932ABE4D96E44

HistoryMay 12, 2023 - 5:25 p.m.

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server traditional and Liberty profile shipped with IBM Business Automation Workflow (CVE-2023-30441)

2023-05-1217:25:50

www.ibm.com

ibm

websphere

application server

vulnerability

security bulletin

liberty

business automation workflow

cve-2023-30441

remediation

fix

enterprise service bus

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

61.6%

JSON

Summary

WebSphere Application Server traditional and WebSphere Application Server Liberty profile are shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional and Liberty profile have been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)	Status	Note
IBM Business Automation Workflow containers	V22.0.2 - V22.0.2-IF003
V22.0.1 - V22.0.1 all fixes
V21.0.3 - V21.0.3-IF012
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes	affected
IBM Business Automation Workflow traditional	V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.0 - V18.0.0.2	affected	Cumulative Fixes cannot automatically install interim fixes for the base Application Server. It is important to follow the complete installation instructions and manually ensure that recommended security fixes are installed.
IBM Business Automation Workflow Enterprise Service Bus	V22.0.2	affected	Cumulative Fixes cannot automatically install interim fixes for the base Application Server. It is important to follow the complete installation instructions and manually ensure that recommended security fixes are installed.
IBM Business Process Manager Enterprise Service Bus	V8.6.0.0-2018.03	affected

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

Please consult the Security Bulletin:Vulnerability in IBM® Java SDK affects IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to CVE-2023-30441 for vulnerability details and information about fixes.

Affected Product(s)	Version(s)	Remediation / Fix
IBM Business Automation Workflow containers	V22.0.2 - V22.0.2-IF003
V22.0.1 - V22.0.1 all fixes	Apply 22.0.2-IF004
IBM Business Automation Workflow containers	V21.0.3 - V21.0.3-IF019
V21.0.2 all fixes
V21.0.1 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes	Apply 21.0.3-IF020 or apply 22.0.2-IF004
IBM Business Automation Workflow traditional	V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.0 - V18.0.0.2	Follow the instructions from the security bulletin mentioned above.
IBM Business Automation Workflow Enterprise Service Bus	V22.0.2	Follow the instructions from the security bulletin mentioned above.
IBM Business Process Manager Enterprise Service Bus	V8.6.0.0-2018.03	Follow the instructions from the security bulletin mentioned above.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmbusiness_process_manager_enterprise_service_busMatch8.6.0.0

ibmbusiness_automation_workflowMatch22.0.2enterprise_service_bus

ibmbusiness_automation_workflowMatch18.0.0.0

ibmbusiness_automation_workflowMatch18.0.0.1

ibmbusiness_automation_workflowMatch18.0.0.2

ibmbusiness_automation_workflowMatch19.0.0.1

ibmbusiness_automation_workflowMatch19.0.0.2

ibmbusiness_automation_workflowMatch19.0.0.3

ibmbusiness_automation_workflowMatch20.0.0.1

ibmbusiness_automation_workflowMatch20.0.0.2

ibmbusiness_automation_workflowMatch21.0.2

ibmbusiness_automation_workflowMatch21.0.3

ibmbusiness_automation_workflowMatch22.0.1

VendorProductVersionCPE
ibmbusiness_process_manager_enterprise_service_bus8.6.0.0cpe:2.3:a:ibm:business_process_manager_enterprise_service_bus:8.6.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow22.0.2cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*
ibmbusiness_automation_workflow18.0.0.0cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.1cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.2cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.1cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.2cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.3cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.1cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.2cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	business_process_manager_enterprise_service_bus	8.6.0.0	cpe:2.3:a:ibm:business_process_manager_enterprise_service_bus:8.6.0.0:::::::*
ibm	business_automation_workflow	22.0.2	cpe:2.3:a:ibm:business_automation_workflow:22.0.2::::enterprise_service_bus:::
ibm	business_automation_workflow	18.0.0.0	cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:::::::*
ibm	business_automation_workflow	18.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:::::::*
ibm	business_automation_workflow	18.0.0.2	cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:::::::*
ibm	business_automation_workflow	19.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:::::::*
ibm	business_automation_workflow	19.0.0.2	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:::::::*
ibm	business_automation_workflow	19.0.0.3	cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:::::::*
ibm	business_automation_workflow	20.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:::::::*
ibm	business_automation_workflow	20.0.0.2	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:::::::*