« Volver al listado

CVE-2021-39046

Estado: ModificadaMedia (4.9)—

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

IBM — Business Automation WorkflowIBM — Business Process Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-39046",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Business Automation Workflow",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.0.0"
            },
            {
              "status": "affected",
              "version": "18.0.0.1"
            },
            {
              "status": "affected",
              "version": "18.0.0.2"
            },
            {
              "status": "affected",
              "version": "19.0.0.1"
            },
            {
              "status": "affected",
              "version": "19.0.0.2"
            },
            {
              "status": "affected",
              "version": "19.0.0.3"
            },
            {
              "status": "affected",
              "version": "20.0.0.1"
            },
            {
              "status": "affected",
              "version": "20.0.0.2"
            },
            {
              "status": "affected",
              "version": "21.0.2"
            },
            {
              "status": "affected",
              "version": "21.0.3"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Business Process Manager",
          "versions": [
            {
              "status": "affected",
              "version": "8.5"
            },
            {
              "status": "affected",
              "version": "8.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-18T16:15:08.403",
  "references": [
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/6564387",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214346",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/6564387",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346."
    },
    {
      "lang": "es",
      "value": "IBM Business Automation Workflow versiones 18.0, 19.0, 20.0 y 21.0, e IBM Business Process Manager versiones 8.5 y 8.6, almacenan las credenciales de usuario en texto sin cifrar que puede leer un usuario privilegiado. IBM X-Force ID: 214346"
    }
  ],
  "lastModified": "2026-06-17T04:03:01.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BC333C1-E9D6-42B0-AC11-2A98FDBFEF4D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83FA507E-26FF-4E54-B241-38F3B2C19C49"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A214C54D-C6DF-408C-BDEA-DCF7DEFBCCA5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAFF08C8-3AF6-4BCF-A06D-6B0EF82DD2C1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D61CA5EC-92A0-469D-8B40-58DBFFEF3DF0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "068CE38A-FBC4-43BF-BD1D-F65F9ADC5141"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B72B33FC-40F4-48DF-AE36-E712F84CEE88"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63E512F2-F36A-42E8-AA7F-63994674731E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}