PT-2021-22316 · Ibm · Ibm Business Process Manager+1

Akenofu · Published 2021-12-21 · Updated 2022-07-12 · CVE-2021-38900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.5 through 8.6 IBM Business Automation Workflow versions 18.0 through 21.0

Description The issue allows a privileged user to obtain highly sensitive information due to improper access controls.

Recommendations For IBM Business Process Manager versions 8.5 through 8.6, update to a version that includes proper access controls to prevent sensitive information disclosure. For IBM Business Automation Workflow versions 18.0 through 21.0, apply configuration changes to restrict access and minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-38900

Affected Products

Ibm Business Automation Workflow

Ibm Business Process Manager

References · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/209607 · Vendor Advisory
• https://ibm.com/support/pages/node/6528296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38900 · Security Note
• https://ibm.com/support/pages/node/6527776 · Vendor Advisory
• https://t.me/cvenotify/24733 · Telegram Post
• https://t.me/cibsecurity/34467 · Telegram Post