5.9

CVE-2021-29753

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Business Automation Workflow Version 18.0.0.0 SwEdition -
Ibm ≫ Business Automation Workflow Version 19.0.0.0 SwEdition -
Ibm ≫ Business Automation Workflow Version 20.0.0.0 SwEdition -
Ibm ≫ Business Automation Workflow Version 21.0.0.0 SwEdition -
Ibm ≫ Business Process Manager Version 8.5.0.0 SwEdition -
Ibm ≫ Business Process Manager Version 8.6.0.0 Update - SwEdition -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.78% 0.51
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
IBM 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://exchange.xforce.ibmcloud.com/vulnerabilities/201919
Vendor Advisory
VDB Entry
https://www.ibm.com/support/pages/node/6513703
Vendor Advisory