CVE-2021-38893

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 55.79%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Business Process Manager Standard IBM Cloud PAK FOR Automation IBM Business Automation Workflow +2 more

Timeline

PublishedDec 21

Latest updateDec 22

Description

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶NVDibm/business_process_manager4 versions+3

▶NVDibm/business_automation_workflow4 versions+3

▶CVEListV5ibm/business_process_manager_standard14 versions+13

▶NVDibm/workflow_process_service21.0.2

▶CVEListV5ibm/cloud_pak_for_automation21.0.2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-cjm6-v8hr-j8c5: IBM Business Process Manager 8↗2021-12-22

▶

CVEList

CVE-2021-38893: IBM Business Process Manager 8↗2021-12-21

▶