2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2022-22361" ,
"sourceIdentifier" : "psirt@us.ibm.com" ,
"published" : "2022-05-31T16:15:07.957" ,
2024-11-23 15:12:23 +00:00
"lastModified" : "2024-11-21T06:46:42.090" ,
"vulnStatus" : "Modified" ,
2024-12-08 03:06:42 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts."
} ,
{
"lang" : "es" ,
"value" : "IBM Business Automation Workflow tradicional versiones 21.0.1 hasta 21.0.3, 20.0.0.1 hasta 20.0.0.2, 19.0.0.1 hasta 19.0.0.3, 18.0.0.0 hasta 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 hasta 20.0.0. 2, IBM Business Process Manager 8.6.0.0 hasta 8.6.0.201803, y 8.5.0.0 hasta 8.5.0.201706 es vulnerable a la falsificaci\u00f3n de petici\u00f3n de sitio cruzado que podr\u00eda permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario en el que el sitio web conf\u00eda"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" ,
2024-11-23 15:12:23 +00:00
"baseScore" : 6.5 ,
"baseSeverity" : "MEDIUM" ,
2023-04-24 12:24:31 +02:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "HIGH" ,
2024-11-23 15:12:23 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 3.6
}
] ,
"cvssMetricV30" : [
{
"source" : "psirt@us.ibm.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.0" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" ,
2024-11-23 15:12:23 +00:00
"baseScore" : 4.3 ,
"baseSeverity" : "MEDIUM" ,
2023-04-24 12:24:31 +02:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "LOW" ,
2024-11-23 15:12:23 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 1.4
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N" ,
2024-11-23 15:12:23 +00:00
"baseScore" : 4.3 ,
2023-04-24 12:24:31 +02:00
"accessVector" : "NETWORK" ,
"accessComplexity" : "MEDIUM" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "PARTIAL" ,
2024-11-23 15:12:23 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.6 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : true
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-352"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "19.0.0.1" ,
"versionEndIncluding" : "19.0.0.3" ,
"matchCriteriaId" : "01362A8C-8482-4AEA-AF8C-62642B6BAD89"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "21.0.1" ,
"versionEndIncluding" : "21.0.3" ,
"matchCriteriaId" : "067C1CD5-4763-4404-86E2-C17520B81ECC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "10B802CE-F898-4B60-9E2C-4D271F9211C7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "8.5.0.0" ,
"versionEndIncluding" : "8.5.0.201706" ,
"matchCriteriaId" : "752B82E1-C25A-4BAE-A4CB-9A8728A6B2A4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "8.6.0.0" ,
"versionEndIncluding" : "8.6.0.201803" ,
"matchCriteriaId" : "3D3DCB5C-38AC-4BF5-8608-53FD1008291F"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784" ,
"source" : "psirt@us.ibm.com" ,
"tags" : [
"VDB Entry" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://www.ibm.com/support/pages/node/6590411" ,
"source" : "psirt@us.ibm.com" ,
"tags" : [
"Patch" ,
"Vendor Advisory"
]
2024-11-23 15:12:23 +00:00
} ,
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/220784" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"VDB Entry" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://www.ibm.com/support/pages/node/6590411" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Patch" ,
"Vendor Advisory"
]
2023-04-24 12:24:31 +02:00
}
]
}
