CVE-2022-35279

CWE-312 — Cleartext Storage of Sensitive Info3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 69.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Business Automation Workflow
Timeline
PublishedNov 3
Latest updateNov 4

Description

"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDibm/business_automation_workflow18.0.0.0 — 18.0.0.2+7
▶CVEListV5ibm_business_automation_workflow"18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1"

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-839x-g2vq-gcpw: "IBM Business Automation Workflow 18↗2022-11-04
▶
CVEList
CVE-2022-35279: "IBM Business Automation Workflow 18↗2022-11-03
▶