cbcvebase.
CVE-2023-24957
published 2023-05-06

CVE-2023-24957: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is…

medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246115.

Affected

13 ranges
VendorProductVersion rangeFixed in
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow——
ibmbusiness_automation_workflow19.0.0.1 – 19.0.0.3—
ibmbusiness_automation_workflow>= 20.0.0.1 < 21.0.321.0.3
ibmbusiness_automation_workflow21.0.1 – 21.0.3.1—
ibmbusiness_automation_workflow>= 22.0.1 < 22.0.222.0.2