CVE-2024-38321

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/294868	Broken Link
https://www.ibm.com/support/pages/node/7162334	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1::::containers:::
	cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2::::containers:::
	cpe:2.3:a:ibm:business_automation_workflow:21.0.2::::containers:::
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if029:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if030:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if031:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if032:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if033:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if034:::containers:::*
	cpe:2.3:a:ibm:business_automation_workflow:22.0.1::::containers:::
	cpe:2.3:a:ibm:business_automation_workflow:22.0.2::::containers:::
	cpe:2.3:a:ibm:business_automation_workflow:23.0.1::::containers:::
	cpe:2.3:a:ibm:business_automation_workflow:23.0.2::::containers:::

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:business_automation_workflow:::::traditional:::*
	cpe:2.3:a:ibm:business_automation_workflow:::::traditional:::*
	cpe:2.3:a:ibm:business_automation_workflow:::::traditional:::*
	cpe:2.3:a:ibm:business_automation_workflow:::::traditional:::*
	cpe:2.3:a:ibm:business_automation_workflow:::::traditional:::*

Configuration 3 (hide)

OR	cpe:2.3:a:ibm:business_automation_workflow:::::enterprise_service_bus:::*
	cpe:2.3:a:ibm:business_automation_workflow:22.0.2::::enterprise_service_bus:::

History

06 Sep 2024, 14:50

Type	Values Removed	Values Added
First Time		Ibm business Automation Workflow Ibm
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.2::::containers::: cpe:2.3:a:ibm:business_automation_workflow:22.0.2::::containers::: cpe:2.3:a:ibm:business_automation_workflow:23.0.1::::containers::: cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if031:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if030:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2::::containers::: cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:23.0.2::::containers::: cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:::::enterprise_service_bus:::* cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1::::containers::: cpe:2.3:a:ibm:business_automation_workflow:::::traditional:::* cpe:2.3:a:ibm:business_automation_workflow:22.0.2::::enterprise_service_bus::: cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if029:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if033:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if032:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:22.0.1::::containers::: cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:::containers:::* cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if034:::containers:::*
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 - Broken Link
References	~~() https://www.ibm.com/support/pages/node/7162334 -~~	() https://www.ibm.com/support/pages/node/7162334 - Vendor Advisory

05 Aug 2024, 12:41

Type	Values Removed	Values Added
Summary		(es) IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2 y 24.0.0 almacena información potencialmente confidencial en archivos de registro en determinadas situaciones que un usuario autenticado podría leer. ID de IBM X-Force: 284868.

03 Aug 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-03 14:15

Updated : 2024-09-06 14:50

NVD link : CVE-2024-38321

Mitre link : CVE-2024-38321

CVE.ORG link : CVE-2024-38321

JSON object : View

Products Affected

ibm

business_automation_workflow

CWE

CWE-532

Insertion of Sensitive Information into Log File

6.5 /10