PT-2020-18116 · Ibm · Ibm Business Process Manager+1

Published 2020-09-25 · Updated 2020-09-29 · CVE-2020-4531

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0 through 20.0 IBM Business Process Manager versions 8.0 through 8.6

Description A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser, potentially using this information for further attacks against the system.

Recommendations For IBM Business Automation Workflow versions 18.0 through 20.0, update to a version that does not return detailed technical error messages in the browser. For IBM Business Process Manager versions 8.0 through 8.6, update to a version that does not return detailed technical error messages in the browser. As a temporary workaround, consider configuring the system to not display detailed technical error messages in the browser until a patch is available.

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2020-4531

Affected Products

Ibm Business Automation Workflow

Ibm Business Process Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-4531 · Security Note
• https://ibm.com/support/pages/node/6336935 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4531 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/182715 · Vendor Advisory