Security Bulletin: An information disclosure security vulnerability has been identified with the embedded Content Navigator component shipped with IBM Business Automation Workflow (CVE-2019-4679)

Summary

Some application server information (the operating system name and version, for example) is included in the response when users log into IBM Content Navigator.

Vulnerability Details

CVEID:CVE-2019-4679
**DESCRIPTION:**IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/171515 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

- IBM Business Automation Workflow V18.0.0.0 through V19.0.0.2

- IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03

- IBM Business Process Manager V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06

- IBM Business Process Manager V8.5.6.0 through V8.5.6.0 Cumulative Fix 2

- IBM Business Process Manager V8.5.5.0

- IBM Business Process Manager V8.5.0.0 through V8.5.0.2

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR JR61912 as soon as practical:

• IBM Business Automation Workflow

For IBM Business Automation Workflow V18.0.0.0 through V19.0.0.3

· Upgrade to at least IBM Business Automation Workflow V19.0.0.3 as required by iFix and then apply iFix JR61912
--OR–
· Apply cumulative fix Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

For IBM Business Process Manager V8.6.0.0 through V8.6.0.0 CF 2018.03
· Apply the remediation, as the version of IBM Content Navigator used by ACCE in Business Process Manager is no longer in support.
--OR–
· Upgrade to Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

For IBM BPM V8.5.0.0 through V8.5.7.0 CF 2017.06
· Apply the remediation, as the version of IBM Content Navigator used by ACCE in Business Process Manager is no longer in support.
--OR–
· Upgrade to Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

Workarounds and Mitigations

IBM Business Process Manager does not embed IBM Content Navigator, but does embed Content Platform Engine which includes Administrator Console for Content Platform Engine (ACCE) application for administering the document store. To remediate this in Business Process Manager, restrict access to the Administation Console for Content Platform Engine (ACCE) application. Allow only limited administrators access to the ACCE application to administer the document store.