Lucene search

K
ibmIBM0034B6EA15575C993E671BC9488C428E47C66347F11CCC745AFE854686C648A7
HistoryMar 23, 2023 - 4:43 p.m.

Security Bulletin: Stored cross-site vulnerability when performing a document upload using Responsive Document Explorer affect IBM Business Automation Workflow - CVE-2023-24957

2023-03-2316:43:19
www.ibm.com
14
ibm business automation workflow
stored cross-site vulnerability
document explorer
cve-2023-24957
cross-site scripting
version
remediation
interim fix
cumulative fix

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.0%

Summary

IBM Business Automation Workflow is vulnerable to a Stored cross-site vulnerability when performing a document upload using Responsive Document Explorer.

Vulnerability Details

CVEID:CVE-2023-24957
**DESCRIPTION:**IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/246115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s) Status
IBM Business Automation Workflow containers

V22.0.2 - V22.0.2-IF001
V22.0.1 all fixes
V21.0.3 - V21.0.3-IF017
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes

| affected
IBM Business Automation Workflow traditional|

V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3

| affected

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT188641 as soon as practical.

Affected Product(s) Version(s) Remediation / Fix
IBM Business Automation Workflow containers V22.0.2 Apply 22.0.2-IF002
IBM Business Automation Workflow containers V22.0.1 Upgrade to Business Automation Workflow on Containers 22.0.2 and apply 22.0.2-IF002
IBM Business Automation Workflow containers V21.0.3 Apply 21.0.3-IF018
or upgrade to 22.0.2-IF002 or later
IBM Business Automation Workflow containers V21.0.2
V20.0.0.1 - V20.0.0.2 Upgrade to 21.0.3-IF018
or upgrade to 22.0.2-IF002 or later
IBM Business Automation Workflow traditional and IBM Business Automation Workflow Enterprise Service Bus V22.0.2 Apply DT188641
IBM Business Automation Workflow traditional V21.0.3.1

Apply DT188641
or upgrade to IBM Business Automation Workflow traditional V22.0.2 and apply DT188641

IBM Business Automation Workflow traditional| V20.0.0.2| Apply DT188641
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251
IBM Business Automation Workflow traditional| V22.0.1
V21.0.2
V20.0.0.1
V19.0.0.3| Upgrade to a long term support release or the latest SSCD version. See IBM Business Automation Workflow and IBM Integration Designer Software Support Lifecycle Addendum

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmbusiness_automation_workflowMatch18.0.0.0
OR
ibmbusiness_automation_workflowMatch18.0.0.1
OR
ibmbusiness_automation_workflowMatch18.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.1
OR
ibmbusiness_automation_workflowMatch19.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.3
OR
ibmbusiness_automation_workflowMatch20.0.0.1
OR
ibmbusiness_automation_workflowMatch20.0.0.2
OR
ibmbusiness_automation_workflowMatch21.0.2
OR
ibmbusiness_automation_workflowMatch21.0.3
OR
ibmbusiness_automation_workflowMatch22.0.1
OR
ibmbusiness_automation_workflowMatch22.0.2
OR
ibmbusiness_automation_workflowMatch22.0.2

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.0%

Related for 0034B6EA15575C993E671BC9488C428E47C66347F11CCC745AFE854686C648A7