Security Bulletin: Cross-Site scripting vulnerability affect IBM Business Automation Workflow - CVE-2023-32339

Summary

IBM Business Automation Workflow is vulnerable to a Cross Site Scripting attack.

Vulnerability Details

CVEID:CVE-2023-32339
**DESCRIPTION:**IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/255587 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

V22.0.2 - V22.0.2.IF004
V22.0.1 all fixes
V21.0.3 - V21.0.3-IF020
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes

| affected
IBM Business Automation Workflow traditional| V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3| affected
IBM Business Automation Workflow Enterprise Service Bus| V22.0.2| affected

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT198220 as soon as practical.

DT198220

Apply DT198220
or upgrade to IBM Business Automation Workflow traditional V22.0.2 and apply DT198220

IBM Business Automation Workflow traditional| V20.0.0.2| Upgrade to IBM Business Automation Workflow traditional V22.0.2 and apply DT198220
IBM Business Automation Workflow traditional| V22.0.1
V21.0.2
V20.0.0.1
V19.0.0.3| Upgrade to a long term support release or the latest SSCD version. See IBM Business Automation Workflow and IBM Integration Designer Software Support Lifecycle Addendum

Workarounds and Mitigations

None