What is CVE-2019-4149?

CVE-2019-4149 is a medium-severity vulnerability in IBM Business Automation Workflow, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-09-05.

How severe is CVE-2019-4149?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in IBM Business Automation Workflow

CVE-2019-4149

IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (50.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Ibm Business Automation Workflow — versions 18.0.0.0, 18.0.0.2
Ibm Business_automation_workflow
Ibm Business Process Manager — versions 8.6.0.0, 8.5.6.0, 8.5.6.0CF2
Ibm Business_process_manager — versions 8.5.6.0, 8.5.7.0, 8.6.0.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (VDB Entry, vdb-entry, Vendor Advisory, x_refsource_XF)

Frequently asked questions

What is CVE-2019-4149?: CVE-2019-4149 is a medium-severity vulnerability in IBM Business Automation Workflow, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-09-05.
How severe is CVE-2019-4149?: Medium severity. CVSS v3 base score is 5.4 out of 10.