CVE-2022-42435 - IBM Business Automation Workflow cross-site request forgery

Back Back to CVE browser

HIGH

IBM Business Automation Workflow cross-site request forgery

Published Jan 3, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.26%

Description

IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054.

Affected products

Vendor IBM Product Business Automation Workflow Default
unaffected
- Version
  18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Business Automation Workflow

unaffected

Version	Status	Constraints
18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45508
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/238054
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6852217
vendor-advisoryPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45508		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/238054		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6852217		vendor-advisoryPatchVendor Advisory