PT-2020-18247 · Ibm · Ibm Business Process Manager+2

Published 2020-12-21 · Updated 2020-12-22 · CVE-2020-4794

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM Automation Workstream Services versions 19.0.3, 20.0.1, 20.0.2 IBM Business Automation Workflow versions 18.0, 19.0, 20.0 IBM Business Process Manager version 8.6

Description The issue is due to improper authorization checking, which could allow an authenticated user to obtain sensitive information or cause a denial of service.

Recommendations For IBM Automation Workstream Services versions 19.0.3, 20.0.1, 20.0.2, update to a version that includes proper authorization checking. For IBM Business Automation Workflow versions 18.0, 19.0, 20.0, update to a version that includes proper authorization checking. For IBM Business Process Manager version 8.6, update to a version that includes proper authorization checking. As a temporary workaround, consider restricting access to sensitive information and implementing additional authorization checks to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-4794

Affected Products

Ibm Automation Workstream Services

Ibm Business Automation Workflow

Ibm Business Process Manager

References · 4

• https://ibm.com/support/pages/node/6359463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4794 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/189445 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4794 · Vendor Advisory