IBM996AEE3E536B9F3710E1CC148FD945A5F8B679E8A643890F8D9C30B4B7C243F8Security Bulletin: Vulnerability in PostCSS affects IBM Business Automation Workflow - CVE-2023-44270
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
9.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.5%
Summary
IBM Business Automation Workflow is depends on a vulnerable version of PostCSS.
Vulnerability Details
CVEID:CVE-2023-44270
**DESCRIPTION:**PostCSS could allow a remote attacker to bypass security restrictions, caused by improper input validaiton. By using a specially crafted external Cascading Style Sheets (CSS), an attacker could exploit this vulnerability to cause \r discrepancies in linters.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/267473 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) | Status |
|---|---|---|
| IBM Business Automation Workflow containers |
V23.0.2 - V23.0.2-IF002
V23.0.1 all fixes
V22.0.2 all fixes
V22.0.1 all fixes
V21.0.3 - V21.0.3-IF030
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes
| affected
IBM Business Automation Workflow traditional| V23.0.1 - V23.0.2
V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3| affected
For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.
Remediation/Fixes
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT260877 as soon as practical.
| Affected Product(s) | Version(s) | Remediation / Fix |
|---|---|---|
| IBM Business Automation Workflow containers | V23.0.2 | Apply 23.0.2-IF003 |
| IBM Business Automation Workflow containers | V21.0.3 | Apply 21.0.3-IF031 |
| or upgrade to 23.0.2-IF003 or later | ||
| IBM Business Automation Workflow containers | V23.0.1 | |
| V22.0.1 - V22.0.2 | ||
| V21.0.1 - V21.0.2 | ||
| V20.0.0.1 - V20.0.0.2 | Upgrade to 21.0.3-IF031 | |
| or upgrade to 23.0.2-IF003 or later | ||
| IBM Business Automation Workflow traditional and IBM Business Automation Workflow Enterprise Service Bus | V23.0.2 | Apply DT260877 |
| IBM Business Automation Workflow traditional | V21.0.3.1 | Apply DT260877 |
| IBM Business Automation Workflow traditional |
V23.0.1
V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.0
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.1 - V18.0.0.3
| Upgrade to a long term support release or the latest SSCD version. See IBM Business Automation Workflow and IBM Integration Designer Software Support Lifecycle Addendum
Workarounds and Mitigations
None
Affected configurations
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
9.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.5%