CVE-2023-32339: IBM Business Automation Workflow cross-site scripting
Published Jun 27, 2023
·Updated
IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected Software
64 affected components
IBM Cloud Pak for Business Automation=18.0.0
IBM Cloud Pak for Business Automation=18.0.2
IBM Cloud Pak for Business Automation=19.0.1
IBM Cloud Pak for Business Automation=19.0.3
IBM Cloud Pak for Business Automation=20.0.1
IBM Cloud Pak for Business Automation=20.0.3
IBM Cloud Pak for Business Automation=21.0.1
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_001
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_002
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_003
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_004
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_005
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_006
IBM Cloud Pak for Business Automation=21.0.1-interim_fix_007
IBM Cloud Pak for Business Automation=21.0.2
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_001
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_0012
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_002
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_003
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_004
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_005
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_006
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_007
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_008
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_009
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_010
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_011
IBM Cloud Pak for Business Automation=21.0.2-interim_fix_012
IBM Cloud Pak for Business Automation=21.0.3
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_001
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_002
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_003
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_004
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_005
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_006
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_007
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_008
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_009
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_010
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_011
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_012
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_013
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_014
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_015
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_016
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_017
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_018
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_019
IBM Cloud Pak for Business Automation=21.0.3-interim_fix_020
IBM Cloud Pak for Business Automation=22.0.1
IBM Cloud Pak for Business Automation=22.0.1-interim_fix_001
IBM Cloud Pak for Business Automation=22.0.1-interim_fix_002
IBM Cloud Pak for Business Automation=22.0.1-interim_fix_003
IBM Cloud Pak for Business Automation=22.0.1-interim_fix_004
IBM Cloud Pak for Business Automation=22.0.1-interim_fix_005
IBM Cloud Pak for Business Automation=22.0.1-interim_fix_006
IBM Cloud Pak for Business Automation=22.0.2
IBM Cloud Pak for Business Automation=22.0.2-interim_fix_001
IBM Cloud Pak for Business Automation=22.0.2-interim_fix_002
IBM Cloud Pak for Business Automation=22.0.2-interim_fix_003
IBM Cloud Pak for Business Automation=22.0.2-interim_fix_004
IBM Cloud Pak for Business Automation<=V22.0.2 - V22.0.2-IF004
IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF020
IBM Cloud Pak for Business Automation<=V22.0.1 - V22.0.1-IF006 and later fixesV21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes
Remediation
Patch Available
Patch Available
Patch Available
Event History
Jun 27, 2023
CVE Published
via MITRE·04:57 PM
Data Sourced
via MITRE·04:57 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-32339?
CVE-2023-32339 has a moderate severity rating due to its potential for credential disclosure through cross-site scripting.
2
How do I fix CVE-2023-32339?
Fix CVE-2023-32339 by applying the appropriate security patches provided by IBM for the affected versions of Cloud Pak for Business Automation.
3
Which versions of IBM Cloud Pak for Business Automation are affected by CVE-2023-32339?
Affected versions include IBM Cloud Pak for Business Automation from V18.0.0 to V22.0.2.
4
What impact does CVE-2023-32339 have on users?
CVE-2023-32339 allows unauthorized users to execute arbitrary JavaScript code, potentially altering the functionality of the web interface.
5
Is it safe to use IBM Cloud Pak for Business Automation without applying the fix for CVE-2023-32339?
Using IBM Cloud Pak for Business Automation without applying the fix for CVE-2023-32339 poses a risk of credential theft and should be addressed immediately.