CVE-2020-4532

CWE-209CWE-200 — Information Exposure3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.2%
top 60.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Business Process ManagerIBM Business Process Manager ExpressIBM Business Automation Workflow
Timeline
PublishedJun 17
Latest updateMay 24

Description

IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5ibm/business_process_manager_express11 versions+10
▶NVDibm/business_process_manager8.5.5.0 — 8.5.7.0+1
▶NVDibm/business_automation_workflow18.0.0.1, 19.0.0.3+1

🔴Vulnerability Details

2
GHSA
GHSA-jf7x-r4m4-rqc9: IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8↗2022-05-24
▶
CVEList
CVE-2020-4532: IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8↗2020-06-17
▶