Lucene search
IBM046790477CCE4E287E81E40847E8A684F6968A14205AB5C712FDACA18E90AE79HistorySep 14, 2022 - 3:28 p.m.
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow and IBM Business Process Manager (CVE-2022-22477)
2022-09-1415:28:14
www.ibm.com
11
ibm
websphere
application server
business automation workflow
business process manager
vulnerability
cve-2022-22477
security bulletin
remediation
cross-site scripting
patch
upgrade
mitigation
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
26.9%
Summary
WebSphere Application Server is shipped as a component of IBM Business Automation Workflow and IBM Business Process Manager. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin.
Vulnerability Details
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Products and Versions
| Affected Product(s) | Version(s) | Status | Note |
|---|---|---|---|
| IBM Business Automation Workflow containers | All versions | Not affected | |
| IBM Business Automation Workflow traditional | V22.0.1 | ||
| V21.0.1 - V21.0.3 | |||
| V20.0.0.1 - V20.0.0.2 | |||
| V19.0.0.1 - V19.0.0.3 | |||
| V18.0.0.0 - V18.0.0.2 | Affected | Cumulative Fixes cannot automatically install interim fixes for the base Application Server. It is important to follow the complete installation instructions and manually ensure that recommended security fixes are installed. | |
| IBM Business Process Manager | V8.6.0.0 - V8.6.0.201803 | ||
| V8.5.0.0 - V8.5.0.201706 | Affected | Cumulative Fixes cannot automatically install interim fixes for the base Application Server. It is important to follow the complete installation instructions and manually ensure that recommended security fixes are installed. |
For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.
Remediation/Fixes
Please consult the security bulletin: IBM WebSphere Application Server is vulnerable to Cross-site Scripting (CVE-2022-22477) for vulnerability details and information about fixes.
Workarounds and Mitigations
None
Affected configurations
Node
ibmbusiness_process_manager_enterprise_service_busMatch8.6.0.0
ORibmbusiness_automation_workflowMatch18.0.0.0
ORibmbusiness_automation_workflowMatch18.0.0.1
ORibmbusiness_automation_workflowMatch18.0.0.2
ORibmbusiness_automation_workflowMatch19.0.0.1
ORibmbusiness_automation_workflowMatch19.0.0.2
ORibmbusiness_automation_workflowMatch19.0.0.3
ORibmbusiness_automation_workflowMatch20.0.0.1
ORibmbusiness_automation_workflowMatch20.0.0.2
ORibmbusiness_automation_workflowMatch21.0.2
ORibmbusiness_automation_workflowMatch21.0.3
ORibmbusiness_automation_workflowMatch22.0.1
ORibmbusiness_process_managerMatch8.6.0.
ORibmbusiness_process_managerMatch201803
ORibmbusiness_process_managerMatch8.6.0.
ORibmbusiness_process_managerMatch201712
ORibmbusiness_process_managerMatch8.6
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201706standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201703standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201612standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201609standard
ORibmbusiness_process_managerMatch8.5.7.standard
ORibmbusiness_process_managerMatch201606standard
ORibmbusiness_process_managerMatch8.5.7standard
ORibmbusiness_process_managerMatch8.5.6.2standard
ORibmbusiness_process_managerMatch8.5.6.1standard
ORibmbusiness_process_managerMatch8.5.6standard
ORibmbusiness_process_managerMatch8.5.5standard
ORibmbusiness_process_managerMatch8.5.0.2standard
ORibmbusiness_process_managerMatch8.5.0.1standard
ORibmbusiness_process_managerMatch8.5standard
ORibmbusiness_process_managerMatch8.6advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201706advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201703advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201612advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201609advanced
ORibmbusiness_process_managerMatch8.5.7.advanced
ORibmbusiness_process_managerMatch201606advanced
ORibmbusiness_process_managerMatch8.5.7advanced
ORibmbusiness_process_managerMatch8.5.6.2advanced
ORibmbusiness_process_managerMatch8.5.6.1advanced
ORibmbusiness_process_managerMatch8.5.6advanced
ORibmbusiness_process_managerMatch8.5.5advanced
ORibmbusiness_process_managerMatch8.5.0.2advanced
ORibmbusiness_process_managerMatch8.5.0.1advanced
ORibmbusiness_process_managerMatch8.5advanced
ORibmbusiness_process_managerMatch8.6.0.express
ORibmbusiness_process_managerMatch201803express
ORibmbusiness_process_managerMatch8.6.0.express
ORibmbusiness_process_managerMatch201712express
ORibmbusiness_process_managerMatch8.6express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201706express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201703express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201612express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201609express
ORibmbusiness_process_managerMatch8.5.7.express
ORibmbusiness_process_managerMatch201606express
ORibmbusiness_process_managerMatch8.5.7express
ORibmbusiness_process_managerMatch8.5.6.2express
ORibmbusiness_process_managerMatch8.5.6.1express
ORibmbusiness_process_managerMatch8.5.6express
ORibmbusiness_process_managerMatch8.5.5express
ORibmbusiness_process_managerMatch8.5.0.2express
ORibmbusiness_process_managerMatch8.5.0.1express
ORibmbusiness_process_managerMatch8.5express
Related
cve
cve
CVE-2022-22477
2022-07-14 17:15:08
ibm
ibm
nessus
nessus
IBM WebSphere Application Server 8.5.x < 8.5.5.23 / 9.0.x < 9.0.5.14 XSS
2022-07-15 00:00:00
prion
prion
Cross site scripting
2022-07-14 17:15:00
nvd
nvd
CVE-2022-22477
2022-07-14 17:15:08
cvelist
cvelist
CVE-2022-22477
2022-07-13 00:00:00
cnvd
cnvd
IBM WebSphere Application Server跨站脚本漏洞
2022-07-18 00:00:00
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
26.9%
Related for 046790477CCE4E287E81E40847E8A684F6968A14205AB5C712FDACA18E90AE79