vulnwire
5.4med

CVE-2019-4149

IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
5.4
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known

IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.

Exploit prediction (EPSS)

0.68% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.05.4CVSS:3.0/AC:L/UI:R/AV:N/I:L/PR:L/A:N/S:C/C:L/RL:O/E:H/RC:C
NVD3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • IBM Business Automation Workflow
  • IBM Business Process Manager

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • ibm.com /support/docview.wss?uid=ibm10885104 · x_refsource_CONFIRM, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/158415 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.