5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
6.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
12.9%
IBM Business Automation Workflow repackages parts of IBM Content Navigator attack. CVE-2023-40684 has been addressed.
CVEID:CVE-2023-40684
**DESCRIPTION:**IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 264019.
CVSS Base score: 4.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/264019 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Affected Product(s) | Version(s) | Status |
---|---|---|
IBM Business Automation Workflow containers |
V23.0.2
| Not affected
IBM Business Automation Workflow containers|
V23.0.1 - V23.0.1-IF003
V22.0.2 all fixes
V22.0.1 all fixes
V21.0.3 - V21.0.3-IF025
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes
| affected
IBM Business Automation Workflow traditional| V23.0.2| not affected
IBM Business Automation Workflow traditional| V23.0.1
V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3| affected
For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT257955 as soon as practical.
Affected Product(s) | Version(s) | Remediation / Fix |
---|---|---|
IBM Business Automation Workflow containers | V23.0.1 - V23.0.1-IF003 |
Apply 23.0.1-IF004 or later or
upgrade to 23.0.2 latest ifix
IBM Business Automation Workflow containers| V21.0.3| Apply 21.0.3-IF026 or
upgrade to 23.0.2 latest ifix
IBM Business Automation Workflow containers| V23.0.1
V22.0.1 - V22.0.2
V21.0.1 - V21.0.2
V20.0.0.1 - V20.0.0.2| Upgrade to 21.0.3-IF026 or
upgrade to 23.0.2 latest ifix
IBM Business Automation Workflow traditional and IBM Business Automation Workflow Enterprise Service Bus| V23.0.2| Apply DT257955
IBM Business Automation Workflow traditional| V21.0.3.1| Apply DT257955
IBM Business Automation Workflow traditional|
V23.0.1
V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.0
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.1 - V18.0.0.3
| Upgrade to a long term support release or the latest SSCD version. See IBM Business Automation Workflow and IBM Integration Designer Software Support Lifecycle Addendum
None
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
6.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
12.9%