CVE-2021-38893

Description

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.

CVSS breakdown

Affected products

• ibm / Business Process Manager Standard8.5 – 8.5
• ibm / Business Process Manager Standard8.5.5 – 8.5.5
• ibm / Business Process Manager Standard8.5.7.CF201706 – 8.5.7.CF201706
• ibm / Business Process Manager Standard8.5.7.CF201703 – 8.5.7.CF201703
• ibm / Business Process Manager Standard8.5.7.CF201612 – 8.5.7.CF201612
• ibm / Business Process Manager Standard8.5.7.CF201609 – 8.5.7.CF201609
• ibm / Business Process Manager Standard8.5.7.CF201606 – 8.5.7.CF201606
• ibm / Business Process Manager Standard8.5.7 – 8.5.7
• ibm / Business Process Manager Standard8.5.6.2 – 8.5.6.2
• ibm / Business Process Manager Standard8.5.6.1 – 8.5.6.1
• ibm / Business Process Manager Standard8.5.6 – 8.5.6
• ibm / Business Process Manager Standard8.6 – 8.6
• ibm / Business Process Manager Standard8.5.0.2 – 8.5.0.2
• ibm / Business Process Manager Standard8.5.0.1 – 8.5.0.1
• ibm / Cloud Pak for Automation21.0.2 – 21.0.2

References

• MISChttps://www.ibm.com/support/pages/node/6527782
• MISChttps://www.ibm.com/support/pages/node/6526488
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/209512