IBM Business Automation Workflow
At a glance
- Source
- NVD
- EPSS
- EPSS 0.93 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ibm
- NVD status
- Modified
Description
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.
Weaknesses (CWE)
- CWE-522 — Insufficiently Protected Credentials
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.9 | CVSS:3.0/I:N/PR:H/AC:L/S:U/AV:N/A:N/UI:N/C:H/E:U/RL:O/RC:C | ibm |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | MEDIUM 4.9 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-25483
- GCVE · GCVE-0-2021-39046
Affected configurations (NVD CPE)
cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| IBM · Business Automation Workflow | affected 18.0.0.0 ; affected 18.0.0.1 ; affected 18.0.0.2 ; affected 19.0.0.1 ; affected 19.0.0.2 ; affected 19.0.0.3 |
| IBM · Business Process Manager | affected 8.5 ; affected 8.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |