Lucene search

[email protected]NVD:CVE-2023-24957

HistoryMay 06, 2023 - 3:15 a.m.

CVE-2023-24957

2023-05-0603:15:09

CWE-79

[email protected]

web.nvd.nist.gov

ibm business automation workflow

cross-site scripting

web ui

javascript

credentials disclosure

ibm x-force id

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.1%

JSON

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115.

Affected configurations

NVD

Node

ibmbusiness_automation_workflowRange19.0.0.1–19.0.0.3

ibmbusiness_automation_workflowRange20.0.0.1–21.0.3containers

ibmbusiness_automation_workflowRange21.0.1–21.0.3.1traditional

ibmbusiness_automation_workflowRange22.0.1–22.0.2containers

ibmbusiness_automation_workflowMatch18.0.0.0-

ibmbusiness_automation_workflowMatch18.0.0.1-

ibmbusiness_automation_workflowMatch18.0.0.2-

ibmbusiness_automation_workflowMatch20.0.0.1traditional

ibmbusiness_automation_workflowMatch20.0.0.2traditional

ibmbusiness_automation_workflowMatch21.0.3-containers

ibmbusiness_automation_workflowMatch21.0.3if002containers

ibmbusiness_automation_workflowMatch21.0.3if005containers

ibmbusiness_automation_workflowMatch21.0.3if006containers

ibmbusiness_automation_workflowMatch21.0.3if007containers

ibmbusiness_automation_workflowMatch21.0.3if008containers

ibmbusiness_automation_workflowMatch21.0.3if009containers

ibmbusiness_automation_workflowMatch21.0.3if010containers

ibmbusiness_automation_workflowMatch21.0.3if011containers

ibmbusiness_automation_workflowMatch21.0.3if012containers

ibmbusiness_automation_workflowMatch21.0.3if013containers

ibmbusiness_automation_workflowMatch21.0.3if014containers

ibmbusiness_automation_workflowMatch21.0.3if015containers

ibmbusiness_automation_workflowMatch21.0.3if016containers

ibmbusiness_automation_workflowMatch21.0.3if017containers

ibmbusiness_automation_workflowMatch22.0.1traditional

ibmbusiness_automation_workflowMatch22.0.2traditional

ibmbusiness_automation_workflowMatch22.0.2-containers

ibmbusiness_automation_workflowMatch22.0.2if001containers

References

exchange.xforce.ibmcloud.com/vulnerabilities/246115

www.ibm.com/support/pages/node/6965776

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.1%

JSON

Related for NVD:CVE-2023-24957

cve1 prion1 cvelist1 ibm2