IBM Support

Security Bulletin: Persistent Cross-Site scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2022-35644

Security Bulletin


Summary

Process Admin Console is vulnerable to a persistent Cross Site-Scripting attack.

Vulnerability Details

CVEID:   CVE-2022-35644
DESCRIPTION:   IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230957 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

 

Affected Product(s)Version(s)Status
IBM Business Automation Workflow containersV22.0.1 - V22.0.1-IF001
V21.0.3 - V21.0.3-IF011
V21.0.2 all fixes
V20.0.0.1 - V20.0.0.2		affected
IBM Business Automation Workflow traditionalV22.0.1
V21.0.1 - V21.0.3 before 21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.0 - V18.0.0.2		affected
IBM Business Process ManagerV8.6.0.0 - V8.6.0.201803
V8.5.0.0 - V8.5.0.201706		affected

 

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT139460 as soon as practical:

Affected Product(s)Version(s)Remediation / Fix
IBM Business Automation Workflow containersV22.0.1 - V22.0.1-IF001Apply 22.0.1-IF002 or
upgrade to a later version than V22.0.1 if available
IBM Business Automation Workflow containersV21.0.3 - V21.0.3-IF011Apply 21.0.3-IF012 or
upgrade to a later version than V22.0.1 if available
IBM Business Automation Workflow containersV21.0.1 - V21.0.2
V20.0.0.1 - V20.0.0.2		Upgrade to V21.0.3 and apply 21.0.3-IF012 or
upgrade to V22.0.1 and apply 22.0.1-IF002 or
upgrade to a later version than V22.0.1 if available
IBM Business Automation Workflow traditionalV22.0.1
V21.0.1 - V21.0.3
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.0 - V18.0.0.2

Apply APAR DT139460

The fix is included in IBM Business Automation Workflow 21.0.3.1

IBM Business Process ManagerV8.6.0.0 - V8.6.0.201803
V8.5.0.0 - V8.5.0.201706

Apply APAR DT139460

 





Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

Change History

02 Sep 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFTBX","label":"IBM Business Process Manager Express"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.6, 8.5.7.CF201706, 8.5.7.CF201703, 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFTN5","label":"IBM Business Process Manager Advanced"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.6, 8.5.7.CF201706, 8.5.7.CF201703, 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFTDH","label":"IBM Business Process Manager Standard"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.6, 8.5.7.CF201706, 8.5.7.CF201703, 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS8JB4","label":"IBM Business Automation Workflow"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2,21.0.2,21.0.3,22.0.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
03 September 2022

UID

ibm16616975

Page Feedback