Rewterz Threat Advisory – Multiple IBM Business Automation And Security Risk Manager Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2021-29878 

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2021-38911 

IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by an authenticated privileged user.

CVE-2021-29912 

IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Impact

• Cross-Site Scripting
• Information Disclosure

Affected Vendors

• IBM

Affected Products

• IBM Business Automation Workflow 18.0.0.0
• IBM Business Automation Workflow 18.0.0.1
• IBM Business Automation Workflow 18.0.0.2
• IBM Business Automation Workflow 19.0.0.1
• IBM Business Automation Workflow 19.0.0.2
• IBM Business Automation Workflow 19.0.0.3
• IBM Business Automation Workflow 20.0.0.1
• IBM Business Automation Workflow 20.0.0.2
• IBM Business Automation Workflow 21.0.2
• IBM Cloud Pak for Security 1.7.2.0
• IBM Cloud Pak for Security 1.7.0.0

Remediation

Refer to IBM Security Bulletin for patch, upgrade, or suggested workaround information.

CVE-2021-29878

CVE-2021-38911

CVE-2021-29912