IBM47CEB24E67CEF991EA13CE9109660D2E39AE1EEE6DC14C801C377498BE8A9B12Security Bulletin: XML External Entity Injection vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2014-3004
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.016 Low
EPSS
Percentile
87.6%
Summary
IBM Business Automation Workflow is vulnerable to a XML External Entity Injection attack.
Vulnerability Details
CVEID:CVE-2014-3004
**DESCRIPTION:**Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/93519 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) | Status |
|---|---|---|
| IBM Business Automation Workflow containers | V22.0.1 - V22.0.1-IF002 | |
| V21.0.3 - V21.0.3-IF013 | ||
| V21.0.2 all fixes | ||
| V20.0.0.2 all fixes | ||
| V20.0.0.1 all fixes | affected | |
| IBM Business Automation Workflow traditional | V22.0.1 | |
| V21.0.1 - V21.0.3.1 | ||
| V20.0.0.1 - V20.0.0.2 | ||
| V19.0.0.1 - V19.0.0.3 | ||
| V18.0.0.0 - V18.0.0.2 | affected | |
| IBM Business Process Manager | V8.6.0.0 - V8.6.0.201803 | |
| V8.5.0.0 - V8.5.0.201706 | affected |
For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.
Remediation/Fixes
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT145251 as soon as practical.
| Affected Product(s) | Version(s) | Remediation / Fix |
|---|---|---|
| IBM Business Automation Workflow containers | V22.0.1 | Apply 22.0.1-IF003 |
| IBM Business Automation Workflow containers | V21.0.3 | Apply 21.0.3-IF014 |
| or upgrade to 22.0.1-IF003 or later | ||
| IBM Business Automation Workflow containers | V21.0.2 | |
| V20.0.0.1 - V20.0.0.2 | Upgrade to 21.0.3-IF014 | |
| or upgrade to 22.0.1-IF003 or later | ||
| IBM Business Automation Workflow traditional | V22.0.1 | Apply DT145251 |
| IBM Business Automation Workflow traditional | V21.0.3 - V21.0.3.1 | Apply DT145251 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251 | ||
| IBM Business Automation Workflow traditional | V21.0.2 | Upgrade to IBM Business Automation Workflow 21.0.3 and apply DT145251 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251 | ||
| IBM Business Automation Workflow traditional | V20.0.0.2 | Apply DT145251 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251 | ||
| IBM Business Automation Workflow traditional | V20.0.0.1 | Upgrade to IBM Business Automation Workflow v20.0.0.2 and apply DT145251 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251 | ||
| IBM Business Automation Workflow traditional | V19.0.0.3 | Apply DT145251 |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251 | ||
| IBM Business Automation Workflow traditional | V19.0.0.1 - V19.0.0.2 | Upgrade to IBM Business Automation Workflow 19.0.0.3 and apply DT145251 (customers with a support extension contract) |
| or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT145251 |
Workarounds and Mitigations
None
Affected configurations
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.016 Low
EPSS
Percentile
87.6%