www.ibm.com
Open in
urlscan Pro
2a02:26f0:3400:183::1e89
Public Scan
URL:
https://www.ibm.com/support/pages/node/6845496
Submission: On December 12 via api from US — Scanned from DE
Submission: On December 12 via api from US — Scanned from DE
Form analysis 3 forms found in the DOM
POST /support/pages/node/6845496
<form action="/support/pages/node/6845496" method="post" id="openid-connect-login-form" accept-charset="UTF-8">
<div><input data-drupal-selector="edit-openid-connect-client-generic-login" type="submit" id="edit-openid-connect-client-generic-login" name="generic" value="Log in with Generic" class="button js-form-submit form-submit">
</div><input autocomplete="off" data-drupal-selector="form-1hrxn-j-2np0ljrr9pobbps0gorqxwolt2ipjybjmhe" type="hidden" name="form_build_id" value="form-1HrXN_j_2nP0Ljrr9PobBpS0GorQXwolT2IPJyBjMhE">
<input data-drupal-selector="edit-openid-connect-login-form" type="hidden" name="form_id" value="openid_connect_login_form">
</form><form class="ibm-row-form ibm-home-search ibm" enctype="multipart/form-data" id="spng-search" ng-submit="omniType()">
<input id="spng-search-query" class="bx--search-input" name="text" size="40" type="search" autocomplete="off" placeholder="Search support or find a product">
<a title="Search" aria-label="Search" href="#" tabindex="-1" id="spng-search-button" ng-click="omniButton()" class="ibm-search-link common-search-link"></a>
<div id="spng-search-typeahead-wrapper" style="display:none" class="search-results-wrapper">
<div id="spng-search-typeahead" class="common-search-results">
<div id="spng-spinner" style="display:none">
<h2 class="ibm-h2 ibm-h4 ibm-bold"><span class="ibm-spinner"> </span></h2>
</div>
<div id="sp-no-results" style="display:none">
<div class="results">
<p>No results were found for your search query.</p>
<div class="ibm-rule">
<hr>
</div>
<h5 class="ibm-h5"><strong>Tips</strong></h5>
<p>To return expected results, you can:</p>
<ul>
<li><strong>Reduce the number of search terms.</strong> Each term you use focuses the search further.</li>
<li><strong>Check your spelling.</strong> A single misspelled or incorrectly typed term can change your result.</li>
<li><strong>Try substituting synonyms for your original terms.</strong> For example, instead of searching for "java classes", try "java training"</li>
<li><strong>Did you search for an IBM acquired or sold product ?</strong> If so, follow the appropriate link below to find the content you need.</li>
</ul>
</div>
</div>
<div id="sp-doc-failure" style="display:none">
<div class="category">Our apologies</div>
<div class="results">
<p>Search results are not available at this time. Please try again later or use one of the other support options on this page.</p>
</div>
</div>
<div id="sp-prev-products" class="result_section"></div>
<div id="sp-wd-results" class="result_section"></div>
<div id="sp-prod-results" class="result_section"></div>
<div id="sp-doc-results" class="result_section"></div>
</div>
</div>
</form>POST /support/pages/node/6845496
<form class="node-security-bulletin-6845496-vote-field-was-this-topic-helpful__vote-vote-votingapi-useful-form vote-form" id="vote-form"
data-drupal-selector="node-security-bulletin-6845496-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" action="/support/pages/node/6845496" method="post" accept-charset="UTF-8">
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-value form-item-value form-no-label">
<select autocomplete="off" data-result-value="-1" data-vote-value="-1" data-style="default" data-show-own-vote="false" data-drupal-selector="edit-value" id="edit-value" name="value" class="form-select select2-widget ibm-widget-processed"
data-jquery-once-autocomplete="true" data-select2-autocomplete-list-widget="true" search-pagesize="10" style="display: none; width: 124px;" tabindex="0" aria-hidden="false">
<option value="-1">Not useful</option>
<option value="1">Useful</option>
</select>
<div class="useful-rating" role="complementary" aria-label="Was this topic helpful?">
<div class="like">
<a href="#"><button aria-label="Yes" tabindex="0" class="ibm-margin-right-1 bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M26,12H20V6a3.0033,3.0033,0,0,0-3-3H14.8672a2.0094,2.0094,0,0,0-1.98,1.7173l-.8453,5.9165L8.4648,16H2V30H23a7.0078,7.0078,0,0,0,7-7V16A4.0045,4.0045,0,0,0,26,12ZM8,28H4V18H8Zm20-5a5.0057,5.0057,0,0,1-5,5H10V17.3027l3.9578-5.9365L14.8672,5H17a1.0008,1.0008,0,0,1,1,1v8h8a2.0025,2.0025,0,0,1,2,2Z"></path></svg><span class="text-yes">Yes</span><span id="like" style="display:none;">999</span></button></a>
</div>
<div class="dislike">
<a href="#"><button aria-label="No" tabindex="0" class="bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M30,16V9a7.0078,7.0078,0,0,0-7-7H2V16H8.4648l3.5774,5.3662.8453,5.9165A2.0094,2.0094,0,0,0,14.8672,29H17a3.0033,3.0033,0,0,0,3-3V20h6A4.0045,4.0045,0,0,0,30,16ZM8,14H4V4H8Zm20,2a2.0025,2.0025,0,0,1-2,2H18v8a1.0008,1.0008,0,0,1-1,1H14.8672l-.9094-6.3662L10,14.6973V4H23a5.0057,5.0057,0,0,1,5,5Z"></path></svg><span class="text-no">No</span><span id="dislike" style="display:none;">No</span></button></a>
</div>
</div>
</div>
<input autocomplete="off" data-drupal-selector="form-fnvuk-fa6i7zzl3w4lcsc6f9myyno07chrj2rpl-cfy" type="hidden" name="form_build_id" value="form-FnVuk-Fa6i7zzl3W4LCSc6f9MyYNo07cHRJ2rpl_CFY">
<input data-drupal-selector="edit-node-security-bulletin-6845496-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" type="hidden" name="form_id"
value="node_security_bulletin_6845496_vote_field_was_this_topic_helpful__vote_vote_votingapi_useful_form">
<input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" name="op" value="Save" class="button button--primary js-form-submit form-submit" data-once="drupal-ajax" style="display: none;">
</form>Text Content
Support My IBM Log in
IBM Support
No results were found for your search query.
--------------------------------------------------------------------------------
TIPS
To return expected results, you can:
* Reduce the number of search terms. Each term you use focuses the search
further.
* Check your spelling. A single misspelled or incorrectly typed term can change
your result.
* Try substituting synonyms for your original terms. For example, instead of
searching for "java classes", try "java training"
* Did you search for an IBM acquired or sold product ? If so, follow the
appropriate link below to find the content you need.
Our apologies
Search results are not available at this time. Please try again later or use one
of the other support options on this page.
SECURITY BULLETIN: CROSS SITE SCRIPTING VULNERABILITY AFFECTS IBM BUSINESS
AUTOMATION WORKFLOW - CVE-2022-41735
SECURITY BULLETIN
SUMMARY
IBM Business Automation Workflow is vulnerable to a Cross Site Scripting attack.
VULNERABILITY DETAILS
CVEID: CVE-2022-41735
DESCRIPTION: IBM Business Process Manager is vulnerable to cross-site
scripting. This vulnerability allows users to embed arbitrary JavaScript code in
the Web UI thus altering the intended functionality potentially leading to
credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/237809 for the current
score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
AFFECTED PRODUCTS AND VERSIONS
Affected Product(s)Version(s)StatusIBM Business Automation Workflow
containersV22.0.1 - V22.0.1-IF004
V21.0.3 - V21.0.3-IF014
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixesaffectedIBM Business Automation Workflow traditionalV22.0.1
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3affected
For earlier and unsupported versions of the products, IBM recommends upgrading
to a fixed, supported version of the product.
REMEDIATION/FIXES
The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix
(CF) containing APAR DT160626 as soon as practical.
Affected Product(s)Version(s)Remediation / FixIBM Business Automation Workflow
containersV22.0.1Apply 22.0.1-IF005 or laterIBM Business Automation Workflow
containersV21.0.3Apply 21.0.3-IF015 or later
or upgrade to 22.0.1-IF005 or laterIBM Business Automation Workflow
containersV21.0.2
V20.0.0.1 - V20.0.0.2Upgrade to 21.0.3-IF015 or later
or upgrade to 22.0.1-IF005 or laterIBM Business Automation Workflow
traditionalV22.0.1Apply DT160626 IBM Business Automation Workflow
traditionalV21.0.3Apply DT160626
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply
DT160626 IBM Business Automation Workflow traditionalV21.0.2Upgrade to IBM
Business Automation Workflow 21.0.3 and apply DT160626
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply
DT160626 IBM Business Automation Workflow traditionalV20.0.0.2Apply DT160626
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply
DT160626 IBM Business Automation Workflow traditionalV20.0.0.1Upgrade to IBM
Business Automation Workflow v20.0.0.2 and apply DT160626
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply
DT160626 IBM Business Automation Workflow traditionalV19.0.0.3Apply DT160626
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply
DT160626 IBM Business Automation Workflow traditionalV19.0.0.1 -
V19.0.0.2Upgrade to IBM Business Automation Workflow 19.0.0.3 and apply
DT160626
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply
DT160626
WORKAROUNDS AND MITIGATIONS
None
GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
Subscribe to My Notifications to be notified of important product support alerts
like this.
REFERENCES
Complete CVSS v3 Guide
On-line Calculator v3
Off
RELATED INFORMATION
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
ACKNOWLEDGEMENT
The vulnerability was reported to IBM by Man Shum,
https://www.linkedin.com/in/man-shum/.
CHANGE HISTORY
06 Dec 2022: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately
impact the Overall CVSS Score. Customers can evaluate the impact of this
vulnerability in their environments by accessing the links in the Reference
section of this Security Bulletin.
DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY
ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to
address potential vulnerabilities, IBM periodically updates the record of
components contained in our product offerings. As part of that effort, if IBM
identifies previously unidentified packages in a product/service inventory, we
address relevant vulnerabilities regardless of CVE date. Inclusion of an older
CVEID does not demonstrate that the referenced product has been used by IBM
since that date, nor that IBM was aware of a vulnerability as of that date. We
are making clients aware of relevant vulnerabilities as we become aware of them.
"Affected Products and Versions" referenced in IBM Security Bulletins are
intended to be only products and versions that are supported by IBM and have not
passed their end-of-support or warranty date. Thus, failure to reference
unsupported or extended-support products and versions in this Security Bulletin
does not constitute a determination by IBM that they are unaffected by the
vulnerability. Reference to one or more unsupported versions in this Security
Bulletin shall not create an obligation for IBM to provide fixes for any
unsupported or extended-support products or versions.
DOCUMENT LOCATION
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o
TPS"},"Product":{"code":"SS8JB4","label":"IBM Business Automation
Workflow"},"Component":"","Platform":[{"code":"PF025","label":"Platform
Independent"}],"Version":"18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2,
19.0.0.3,20.0.0.1, 20.0.0.2,21.0.2,21.0.3,22.0.1","Edition":"","Line of
Business":{"code":"LOB45","label":"Automation"}}]
WAS THIS TOPIC HELPFUL?
Not usefulUseful
Yes999
NoNo
DOCUMENT INFORMATION
More support for:
IBM Business Automation Workflow
Software version:
18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1,
20.0.0.2,21.0.2,21.0.3,22.0.1
Document number:
6845496
Modified date:
06 December 2022
UID
ibm16845496
You will be taken to the My Notifications interface where you have been
auto-subscribed to IBM Business Automation Workflow
You can click the EDIT menu option to configure your subscription experience.
You can also search for and select other IBM products to subscribe to based on
your needs.
CancelOK
Manage My Notification Subscriptions
Click the Subscribe button to stay informed of critical IBM support updates with
My Notifications.
Take a proactive approach to problem prevention.
Receive support content tailored to your needs, delivered directly to you!
Receive immediate notifications of Security Bulletins and Flashes.
Receive daily or weekly notifications of technical support information such as
downloads, tips, technical notes, and publications.
Log in to Subscribe
Page Feedback
Close
SHARE YOUR FEEDBACK
NEED SUPPORT?
* Submit feedback to IBM Support
* 1-800-IBM-7378 (USA)
* Directory of worldwide contacts
Top products & platforms Industries Artificial intelligence Blockchain Business
operations Cloud computing Data & Analytics Hybrid cloud IT infrastructure
Security Supply chain What is Hybrid Cloud? What is Artificial intelligence?
What is Cloud Computing? What is Kubernetes? What are Containers? What is
DevOps? What is Machine Learning? IBM Consulting Communities Developer education
Support - Download fixes, updates & drivers IBM Research Partner with us -
PartnerWorld Training - Courses Upcoming events & webinars Annual report Career
opportunities Corporate social responsibility Diversity & inclusion Industry
analyst reports Investor relations News & announcements Thought leadership
Security, privacy & trust About IBM LinkedIn Twitter Instagram Subscription
Center Contact IBM Privacy Terms of use Accessibility United States — English
Share your feedback
IBM web domains
ibm.com, ibm.dev, ibm.org, ibm-zcouncil.com, insights-on-business.com, jazz.net,
merge.com, micromedex.com, mobilebusinessinsights.com, promontory.com,
proveit.com, ptech.org, resource.com, s81c.com, securityintelligence.com,
skillsbuild.org, softlayer.com, storagecommunity.org, strongloop.com,
teacheradvisor.org, think-exchange.com, thoughtsoncloud.com, trusteer.com,
truven.com, truvenhealth.com, alphaevents.webcasts.com, betaevents.webcasts.com,
ibm-cloud.github.io, ibmbigdatahub.com, bluemix.net, mybluemix.net, ibm.net,
ibmcloud.com, redhat.com, galasa.dev, blueworkslive.com, swiss-quantum.ch,
altoromutual.com, blueworkslive.cn, blueworkslive.com, cloudant.com, ibm.ie,
ibm.fr, ibm.com.br, ibm.co, ibm.ca, silverpop.com,
community.watsonanalytics.com, eclinicalos.com, datapower.com,
ibmmarketingcloud.com, thinkblogdach.com, truqua.com, my-invenio.com,
skills.yourlearning.ibm.com, bluewolf.com, asperasoft.com, instana.com,
taos.com, envizi.com
About cookies on this site Our websites require some cookies to function
properly (required). In addition, other cookies may be used with your consent to
analyze site usage, improve the user experience and for advertising. For more
information, please review your cookie preferences options and IBM’s privacy
statement. To provide a smooth navigation, your cookie preferences will be
shared across the IBM web domains listed here.
Accept all Required only