5.9
CVE-2021-29753
- EPSS 0.07%
- Veröffentlicht 05.11.2021 18:15:09
- Zuletzt bearbeitet 21.11.2024 06:01:44
- Quelle psirt@us.ibm.com
- Teams Watchlist Login
- Unerledigt Login
IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Business Automation Workflow Version18.0.0.0 SwEdition-
Ibm ≫ Business Automation Workflow Version19.0.0.0 SwEdition-
Ibm ≫ Business Automation Workflow Version20.0.0.0 SwEdition-
Ibm ≫ Business Automation Workflow Version21.0.0.0 SwEdition-
Ibm ≫ Business Process Manager Version8.5.0.0 SwEdition-
Ibm ≫ Business Process Manager Version8.6.0.0 Update- SwEdition-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.183 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
| psirt@us.ibm.com | 5.9 | 2.2 | 3.6 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-319 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.