Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM5A62C4ED4A29BBD79F41A535ED339486C5E2F1E055B68C2F032879EF81DD5997
HistoryFeb 10, 2023 - 2:34 p.m.

Security Bulletin: Path traversal vulnerability affects IBM Business Automation Workflow - CVE-2022-43864

2023-02-1014:34:15
www.ibm.com
29
ibm business automation workflow
path traversal attack
v22.0.2
v22.0.1
v21.0.3
v21.0.2
v20.0.0.2
v20.0.0.1
v21.0.3.1
v20.0.0.1
v19.0.0.1
v19.0.0.3
dt172088
vulnerability
remediation
ifix
cf
apply fix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.2%

JSON

Summary

IBM Business Automation Workflow is vulnerable to a Path Traversal attack.

Vulnerability Details

CVEID:CVE-2022-43864
**DESCRIPTION:**IBM Business Automation Workflow could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing “dot dot” sequences (/…/) to view arbitrary files on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239427 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s) Status
IBM Business Automation Workflow containers

V22.0.2 - V22.0.2 all fixes
V22.0.1 - V22.0.1 all fixes
V21.0.3 - V21.0.3 all fxes
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes

| not affected
IBM Business Automation Workflow traditional | V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3 | affected
IBM Business Automation Workflow Enterprise Service Bus | V22.0.2 | affected

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT172088 as soon as practical.

Affected Product(s) Version(s) Remediation / Fix
IBM Business Automation Workflow traditional and IBM Business Automation Workflow Enterprise Service Bus V22.0.2 Apply DT172088
IBM Business Automation Workflow traditional V21.0.3.1

Apply DT172088
or upgrade to IBM Business Automation Workflow traditional V22.0.2 and apply DT172088

IBM Business Automation Workflow traditional | V20.0.0.2 | Apply DT172088
or upgrade to IBM Business Automation Workflow traditional V22.0.2 and apply DT172088
IBM Business Automation Workflow traditional | V22.0.1
V21.0.1 - V21.0.2
V20.0.0.1
V19.0.0.1 - V19.0.0.3
and earlier unsupported versions | Upgrade to a long term support release or the latest SSCD version. See IBM Business Automation Workflow and IBM Integration Designer Software Support Lifecycle Addendum

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmbusiness_automation_workflowMatch22.0.2enterprise_service_bus
OR
ibmbusiness_automation_workflowMatch18.0.0.0
OR
ibmbusiness_automation_workflowMatch18.0.0.1
OR
ibmbusiness_automation_workflowMatch18.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.1
OR
ibmbusiness_automation_workflowMatch19.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.3
OR
ibmbusiness_automation_workflowMatch20.0.0.1
OR
ibmbusiness_automation_workflowMatch20.0.0.2
OR
ibmbusiness_automation_workflowMatch21.0.2
OR
ibmbusiness_automation_workflowMatch21.0.3
OR
ibmbusiness_automation_workflowMatch22.0.1
OR
ibmbusiness_automation_workflowMatch22.0.2
VendorProductVersionCPE
ibmbusiness_automation_workflow22.0.2cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*
ibmbusiness_automation_workflow18.0.0.0cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.1cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.2cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.1cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.2cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.3cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.1cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.2cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow21.0.2cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*
Rows per page:
1-10 of 131

Related

cve 1
cvelist 1
ibm 1
prion 1
nvd 1
cve
cve
CVE-2022-43864
2023-01-26 21:17:48
cvelist
cvelist
CVE-2022-43864 IBM Business Automation Workflow information disclosure
2023-01-25 18:07:21
ibm
ibm
Security Bulletin: Path traversal vulnerability affects IBM Business Monitor - CVE-2022-43864
2023-01-24 08:20:32
prion
prion
Design/Logic Flaw
2023-01-26 21:17:00
nvd
nvd
CVE-2022-43864
2023-01-26 21:17:48

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.2%

JSON
Related for 5A62C4ED4A29BBD79F41A535ED339486C5E2F1E055B68C2F032879EF81DD5997
cve1cvelist1ibm1prion1nvd1