PT-2022-15391 · Ibm · Ibm Business Automation Workflow+1

Published 2022-05-31 · Updated 2022-06-10 · CVE-2022-22361

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow traditional versions 21.0.1 through 21.0.3 IBM Business Automation Workflow traditional versions 20.0.0.1 through 20.0.0.2 IBM Business Automation Workflow traditional versions 19.0.0.1 through 19.0.0.3 IBM Business Automation Workflow traditional versions 18.0.0.0 through 18.0.0.1 IBM Business Automation Workflow containers versions 21.0.1 through 21.0.3 IBM Business Automation Workflow containers versions 20.0.0.1 through 20.0.0.2 IBM Business Process Manager versions 8.6.0.0 through 8.6.0.201803 IBM Business Process Manager versions 8.5.0.0 through 8.5.0.201706

Description The issue is related to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Recommendations For IBM Business Automation Workflow traditional versions 21.0.1 through 21.0.3, update to a version outside of this range to resolve the issue. For IBM Business Automation Workflow traditional versions 20.0.0.1 through 20.0.0.2, update to a version outside of this range to resolve the issue. For IBM Business Automation Workflow traditional versions 19.0.0.1 through 19.0.0.3, update to a version outside of this range to resolve the issue. For IBM Business Automation Workflow traditional versions 18.0.0.0 through 18.0.0.1, update to a version outside of this range to resolve the issue. For IBM Business Automation Workflow containers versions 21.0.1 through 21.0.3, update to a version outside of this range to resolve the issue. For IBM Business Automation Workflow containers versions 20.0.0.1 through 20.0.0.2, update to a version outside of this range to resolve the issue. For IBM Business Process Manager versions 8.6.0.0 through 8.6.0.201803, update to a version outside of this range to resolve the issue. For IBM Business Process Manager versions 8.5.0.0 through 8.5.0.201706, update to a version outside of this range to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-22361

Affected Products

Ibm Business Automation Workflow

Ibm Business Process Manager

References · 7

• https://ibm.com/support/pages/node/6590411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22361 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22361 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/220784 · Vendor Advisory
• https://t.me/cvenotify/31439 · Telegram Post
• https://t.me/cvenotify/30918 · Telegram Post
• https://t.me/cibsecurity/43571 · Telegram Post