Lucene search

IBM7E5495D9284717AC530CC6445595906FCC5C325DFFA2230927CA38BE0D87E6FF

HistoryFeb 01, 2023 - 9:34 p.m.

Security Bulletin: IBM Process Mining is vulnerable to phishing attacks due to URI.js. CVE-2022-0868

2023-02-0121:34:59

www.ibm.com

ibm process mining

uri.js

vulnerability

phishing

cve-2022-0868

open redirect

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

30.0%

JSON

Summary

URI.js is used by IBM Process Mining. CVE-2022-0868.

Vulnerability Details

CVEID:CVE-2022-0868
**DESCRIPTION:**URI.js could allow a remote authenticated attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221212 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Process Mining	1.12.0.3

Remediation/Fixes

Remediation/Fixes guidance:

Product(s)	Version(s) number and/or range	Remediation/Fix/Instructions
IBM Process Mining	1.12.0.3

Upgrade to version 1.12.0.4

1.Login to PassPortAdvantage

2. Search for
M05JKML Process Mining 1.12.0.4 Server Multiplatform Multilingual

3. Download package

4. Follow install instructions

5. Repeat for M05JJML Process Mining 1.12.0.4 Client Windows Multilingual

| |

Workarounds and Mitigations

None known

Affected configurations

Vulners

Node

ibmcloud_pak_for_automationMatch1.12.0.3

CPENameOperatorVersion
ibm cloud pak for automationeq1.12.0.3

CPE	Name	Operator	Version
	ibm cloud pak for automation	eq	1.12.0.3

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

30.0%

JSON

Related for 7E5495D9284717AC530CC6445595906FCC5C325DFFA2230927CA38BE0D87E6FF