IBM3EB6302D396E6C00E098D23052A890C452B226B34DB75AF6B9544ED5E13DA743Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2021-21252
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.004 Low
EPSS
Percentile
71.7%
Summary
There is a vulnerability CVE-2021-21252 which affects IBM Engineering Workflow Management (EWM).
Vulnerability Details
CVEID:CVE-2021-21252
**DESCRIPTION:**jQuery Validation Plugin is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw when validating forms. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/194982 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| EWM | 7.0.2 |
| EWM | 7.0.1 |
Remediation/Fixes
Upgrade to version 7.0.2 iFix020 or later
IBM Engineering Lifecycle Management 7.0.2 iFix020
IBM Engineering Workflow Management 7.0.2 iFix020
Upgrade to version 7.0.1 iFix020 or later
IBM Engineering Lifecycle Management 7.0.1 iFix020
IBM Engineering Workflow Management 7.0.1 iFix020
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm engineering workflow management | eq | 7.0.1 | |
| ibm engineering workflow management | eq | 7.0.2 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.004 Low
EPSS
Percentile
71.7%