Severity
Medium
Analysis Summary
CVE-2021-29878
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2021-38911
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by an authenticated privileged user.
CVE-2021-29912
IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Impact
- Cross-Site Scripting
- Information Disclosure
Affected Vendors
- IBM
Affected Products
- IBM Business Automation Workflow 18.0.0.0
- IBM Business Automation Workflow 18.0.0.1
- IBM Business Automation Workflow 18.0.0.2
- IBM Business Automation Workflow 19.0.0.1
- IBM Business Automation Workflow 19.0.0.2
- IBM Business Automation Workflow 19.0.0.3
- IBM Business Automation Workflow 20.0.0.1
- IBM Business Automation Workflow 20.0.0.2
- IBM Business Automation Workflow 21.0.2
- IBM Cloud Pak for Security 1.7.2.0
- IBM Cloud Pak for Security 1.7.0.0
Remediation
Refer to IBM Security Bulletin for patch, upgrade, or suggested workaround information.