Lucene search

IbmCVE-2024-38321

HistoryAug 03, 2024 - 2:15 p.m.

CVE-2024-38321

2024-08-0314:15:48

CWE-532

ibm

web.nvd.nist.gov

ibm business automation workflow

sensitive information

log files

authenticated user

security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

18.8%

JSON

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868.

Affected configurations

Nvd

Vulners

Node

ibmbusiness_automation_workflowMatch20.0.0.1containers

ibmbusiness_automation_workflowMatch20.0.0.2containers

ibmbusiness_automation_workflowMatch21.0.2containers

ibmbusiness_automation_workflowMatch21.0.3-containers

ibmbusiness_automation_workflowMatch21.0.3if002containers

ibmbusiness_automation_workflowMatch21.0.3if005containers

ibmbusiness_automation_workflowMatch21.0.3if006containers

ibmbusiness_automation_workflowMatch21.0.3if007containers

ibmbusiness_automation_workflowMatch21.0.3if008containers

ibmbusiness_automation_workflowMatch21.0.3if009containers

ibmbusiness_automation_workflowMatch21.0.3if010containers

ibmbusiness_automation_workflowMatch21.0.3if011containers

ibmbusiness_automation_workflowMatch21.0.3if012containers

ibmbusiness_automation_workflowMatch21.0.3if013containers

ibmbusiness_automation_workflowMatch21.0.3if014containers

ibmbusiness_automation_workflowMatch21.0.3if015containers

ibmbusiness_automation_workflowMatch21.0.3if016containers

ibmbusiness_automation_workflowMatch21.0.3if017containers

ibmbusiness_automation_workflowMatch21.0.3if028containers

ibmbusiness_automation_workflowMatch21.0.3if029containers

ibmbusiness_automation_workflowMatch21.0.3if030containers

ibmbusiness_automation_workflowMatch21.0.3if031containers

ibmbusiness_automation_workflowMatch21.0.3if032containers

ibmbusiness_automation_workflowMatch21.0.3if033containers

ibmbusiness_automation_workflowMatch21.0.3if034containers

ibmbusiness_automation_workflowMatch22.0.1containers

ibmbusiness_automation_workflowMatch22.0.2containers

ibmbusiness_automation_workflowMatch23.0.1containers

ibmbusiness_automation_workflowMatch23.0.2containers

Node

ibmbusiness_automation_workflowRange19.0.0.1–19.0.0.3traditional

ibmbusiness_automation_workflowRange20.0.0.1–20.0.0.2traditional

ibmbusiness_automation_workflowRange21.0.1–21.0.3.0traditional

ibmbusiness_automation_workflowRange22.0.1–22.0.2traditional

ibmbusiness_automation_workflowRange23.0.1–23.0.2traditional

Node

ibmbusiness_automation_workflowRange23.0.1–23.0.2enterprise_service_bus

ibmbusiness_automation_workflowMatch22.0.2enterprise_service_bus

VendorProductVersionCPE
ibmbusiness_automation_workflow20.0.0.1cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:containers:*:*:*
ibmbusiness_automation_workflow20.0.0.2cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.2cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*

Vendor	Product	Version	CPE
ibm	business_automation_workflow	20.0.0.1	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1::::containers:::
ibm	business_automation_workflow	20.0.0.2	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2::::containers:::
ibm	business_automation_workflow	21.0.2	cpe:2.3:a:ibm:business_automation_workflow:21.0.2::::containers:::
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:::containers:::*
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:::containers:::*
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:::containers:::*
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:::containers:::*
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:::containers:::*
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:::containers:::*
ibm	business_automation_workflow	21.0.3	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:::containers:::*

Rows per page:

1-10 of 321

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:*",
      "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:*",
      "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:-:*:*:*",
      "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:-:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "Business Automation Workflow",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "22.0.2, 23.0.1, 23.0.2, 24.0.0"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/294868

www.ibm.com/support/pages/node/7162334

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

18.8%

JSON

Related for CVE-2024-38321