6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
55.6%
Configuration Editor in IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a HTTP request smuggling attack.
CVEID:CVE-2021-22960
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling, caused by an error when parsing the body of chunked requests. A remote attacker could send a specially-crafted request to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211171 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVEID:CVE-2021-22959
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attacker could send a specially-crafted request with a space (SP) right after the header name before the colon to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211168 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Product(s) | Version(s) | Status |
---|---|---|
IBM Business Automation Workflow traditional | V21.0.3 | not affected |
IBM Business Automation Workflow traditional | V21.0.2 | |
V20.0.0.1 - V20.0.0.2 | ||
V19.0.0.1 - V19.0.0.3 | ||
V18.0.0.0 - V18.0.0.1 | affected | |
IBM Business Automation Workflow containers | V21.0.1 - V21.0.3 | |
V20.0.0.1 - V20.0.0.2 | not affected | |
IBM Business Process Manager | V8.6.0.0 - V8.6.0.201803 | |
V8.5.0.0 - V8.5.0.201706 | affected |
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR JR64322 as soon as practical.
Affected Product(s) | Version(s) | Remediation / Fix |
---|---|---|
IBM Business Automation Workflow traditional | V21.0.2 | Apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 |
IBM Business Automation Workflow traditional | V20.0.0.2 | Apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 |
IBM Business Automation Workflow traditional | V20.0.0.1 | Upgrade to IBM Business Automation Workflow v20.0.0.2 and apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 |
IBM Business Automation Workflow traditional | V19.0.0.3 | Apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 |
IBM Business Automation Workflow traditional | V19.0.0.2 | |
V19.0.0.1 | ||
V18.0.0.2 | ||
V18.0.0.1 | Upgrade to IBM Business Automation Workflow 19.0.0.3 and apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 | |
IBM Business Automation Workflow traditional | V18.0.0.0 | Apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 |
IBM Business Process Manager | V8.6.0.0 - V8.6.0.201803 | Upgrade to IBM Business Process Manager Version 8.6 Cumulative Fix 2018.03 and apply JR64322 or upgrade to IBM Business Automation Workflow 21.0.3 |
IBM Business Process Manager | V8.5.0.0 - V8.5.7.201706 | Upgrade to IBM Business Process Manager Version 8.5.7 Cumulative Fix 2017.06 and apply JR64322 for the edition of your product |
IBM BPM Configuration Editor is a stand-alone tool for editing properties file. Use a standard text file editor instead.
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
55.6%