A vulnerability in IBM FileNet Content Manager and Case Foundation, in some case, could contain user information in the log when Process Orchestration Web Services is invoked.
CVEID:CVE-2019-4572
**DESCRIPTION:**IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an administrator on the local machine. IBM X-Force ID: 166798.
CVSS Base score: 4.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166798 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Business Automation Workflow |
18.0.0
19.0.0
Note: CVE-2019-4572 affects only IBM Business Automation Workflow V18.0.0.2 or later.
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR JR61896 as soon as practical:
For IBM Business Automation Workflow V18.0.0.2 through V19.0.0.3
ยท Upgrade to at least IBM Business Automation Workflow V19.0.0.2 as required by iFix and then apply iFix JR61896
--ORโ
ยท Apply cumulative fix Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)
None