CVE-2018-1997 — IBM Business Automation Workflow vulnerability

4 documents4 sources

Severity

6.5MEDIUMNVD

CNA4.3

EPSS

0.2%

top 59.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Business Automation Workflow IBM Business Process Manager

Timeline

PublishedApr 8

Latest updateMay 13

Description

IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDibm/business_process_manager4 versions+3

▶CVEListV5ibm/business_automation_workflow18.0.0.0, 18.0.0.1, 18.0.0.2+2

▶NVDibm/business_automation_workflow18.0.0.0, 18.0.0.1, 18.0.0.2+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-xcgx-f24f-jj4r: IBM Business Automation Workflow and Business Process Manager 18↗2022-05-13

▶

CVEList

CVE-2018-1997: IBM Business Automation Workflow and Business Process Manager 18↗2019-04-08

▶

💥Exploits & PoCs

Exploit-DB

PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow↗2018-06-06

▶