5.9
CVE-2021-29753
- EPSS 0.07%
- Published 05.11.2021 18:15:09
- Last modified 21.11.2024 06:01:44
- Source psirt@us.ibm.com
- Teams watchlist Login
- Open Login
IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Data is provided by the National Vulnerability Database (NVD)
Ibm ≫ Business Automation Workflow Version18.0.0.0 SwEdition-
Ibm ≫ Business Automation Workflow Version19.0.0.0 SwEdition-
Ibm ≫ Business Automation Workflow Version20.0.0.0 SwEdition-
Ibm ≫ Business Automation Workflow Version21.0.0.0 SwEdition-
Ibm ≫ Business Process Manager Version8.5.0.0 SwEdition-
Ibm ≫ Business Process Manager Version8.6.0.0 Update- SwEdition-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.183 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
| psirt@us.ibm.com | 5.9 | 2.2 | 3.6 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-319 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.