CVE-2020-4768 — Cross-site Scripting in IBM Business Automation Workflow

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.1%
top 70.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Business Automation WorkflowIBM Case Manager
Timeline
PublishedFeb 11
Latest updateMay 24

Description

IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶NVDibm/business_automation_workflow18.0.0.0 — 20.0.0.2
▶CVEListV5ibm/business_automation_workflow18.0, 19.0, 20.0+2
▶NVDibm/case_manager5.2.0 — 5.3.3
▶CVEListV5ibm/case_manager5.2, 5.3+1

🔴Vulnerability Details

2
GHSA
GHSA-v2fm-g8p8-hmh2: IBM Case Manager 5↗2022-05-24
▶
CVEList
CVE-2020-4768: IBM Case Manager 5↗2021-02-11
▶
CVE-2020-4768 — Cross-site Scripting in IBM | cvebase