IBM7D2FDDAF16E6C5205CAEE8D2013EF2223D6D32332AE3794B42ADEDFDAA470A16Security Bulletin: Cross-site scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38893
0.001 Low
EPSS
Percentile
23.7%
Summary
IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a cross-site scripting attack.
Vulnerability Details
CVEID:CVE-2021-38966
**DESCRIPTION:**IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/212357 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) | Status |
|---|---|---|
| IBM Business Automation Workflow traditional | V21.0.3 | not affected |
| IBM Business Automation Workflow traditional | V21.0.1 - V21.0.2 | |
| V20.0.0.1 - V20.0.0.2 | ||
| V19.0.0.1 - V19.0.0.3 | ||
| V18.0.0.0 - V18.0.0.1 | affected | |
| IBM Business Automation Workflow containers | V21.0.1 - V21.0.2 | |
| V20.0.0.1 - V20.0.0.2 | affected | |
| IBM Business Process Manager | V8.6.0.0 - V8.6.0.201803 | |
| V8.5.0.0 - V8.5.0.201706 | affected |
Remediation/Fixes
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR JR64102 as soon as practical.
| Affected Product(s) | Version(s) | Remediation / Fix |
|---|---|---|
| IBM Business Automation Workflow traditional | V21.0.2 | Apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Automation Workflow containers | V21.0.2 | Apply 21.0.2-IF006 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Automation Workflow traditional | V20.0.0.2 | Apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Automation Workflow containers | V20.0.0.2 | Apply 20.0.3-IF013 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Automation Workflow traditional | V20.0.0.1 | Upgrade to IBM Business Automation Workflow v20.0.0.2 and apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Automation Workflow traditional | V19.0.0.3 | Apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Automation Workflow traditional | V19.0.0.2 | |
| V19.0.0.1 | ||
| V18.0.0.2 | ||
| V18.0.0.1 | Upgrade to IBM Business Automation Workflow 19.0.0.3 and apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 | |
| IBM Business Automation Workflow traditional | V18.0.0.0 | Apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Process Manager | V8.6.0.0 - V8.6.0.201803 | Upgrade to IBM Business Process Manager Version 8.6 Cumulative Fix 2018.03 and apply JR64102 or upgrade to IBM Business Automation Workflow 21.0.3 |
| IBM Business Process Manager | V8.5.0.0 - V8.5.7.201706 | Upgrade to IBM Business Process Manager Version 8.5.7 Cumulative Fix 2017.06 and apply JR64102 for the edition of your product |
- IBM Business Process Manager Advanced
- IBM Business Process Manager Standard
- IBM Business Process Manager Express
or upgrade to IBM Business Automation Workflow 21.0.3
Workarounds and Mitigations
None
Related
0.001 Low
EPSS
Percentile
23.7%