« Volver al listado

CVE-2024-43188

Estado: AnalizadaMedia (4.9)—

IBM Business Automation Workflow

22.0.2, 23.0.1, 23.0.2, and 24.0.0

could allow a privileged user to perform unauthorized activities due to improper client side validation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Business Automation Workflow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-43188",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-43188",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-18T13:23:48.735450Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:-:*:*:*",
            "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:-:*:*:*",
            "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:-:*:*:*",
            "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:-:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Business Automation Workflow",
          "versions": [
            {
              "status": "affected",
              "version": "22.0.2, 23.0.1, 23.0.2, 24.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-18T12:15:02.867",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7168769",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-602"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Business Automation Workflow \n\n22.0.2, 23.0.1, 23.0.2, and 24.0.0\n\ncould allow a privileged user to perform unauthorized activities due to improper client side validation."
    },
    {
      "lang": "es",
      "value": "IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2 y 24.0.0 podrían permitir que un usuario privilegiado realice actividades no autorizadas debido a una validación incorrecta del lado del cliente."
    }
  ],
  "lastModified": "2026-06-17T07:50:34.980",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F74D99AD-0570-49B3-9B0D-6F28FA9564B4",
              "versionEndIncluding": "18.0.0.3",
              "versionStartIncluding": "18.0.0.1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB90C98C-7A38-4B9B-878C-028DD872D19C",
              "versionEndIncluding": "19.0.0.3",
              "versionStartIncluding": "19.0.0.1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47064639-B3A7-4F99-8823-40D2C9FE3C1A",
              "versionEndIncluding": "21.0.3.1",
              "versionStartIncluding": "21.0.1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D36329EB-4317-4AB1-85FA-4E23F185C179"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C7FDEC2-CBE3-4C5B-917D-37F2612018FB"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C6D1E72-FC9F-4A0A-8E80-A3CA8CB0EDAA"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFB13BEC-206E-41B3-A4F3-9281EBB0E213"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7C0BC37-0F42-463F-B2E4-F2B3D3958314"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E9F20F6-4D3B-4AD6-9F6B-E145598FFEE2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:*:*:*:traditional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95CE7462-D6B6-41AE-BD90-E2D65E0318A3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}