Medium WID-SEC-2025-0299 6 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen

Published Feb 9, 2025 · Updated Feb 9, 2025 · de-DE

Vendor: IBM Product: Business Automation Workflow Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen, einen Denial of Service herbeizuführen oder um ein Cross-Site-Scritping auszuführen.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 6

High 7.5

CVE-2024-21538

Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very la…

katib-suggestion-hyperopt katib-earlystopping katib-suggestion-skopt-enas katib-suggestion-optuna-enas Azure Linux Alpine Wolfi npm

Nov 8, 2024
High 7.5

CVE-2024-28168

Apache XML Graphics FOP: XML External Entity (XXE) Processing

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

Apache Software Foundation Apache XML Graphics FOP fop fop Debian Ubuntu Maven

Oct 9, 2024
Medium 6.4

CVE-2024-52365

IBM Cloud Pak for Business Automation cross-site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbit…

IBM Cloud Pak for Business Automation

Feb 5, 2025
Medium 5.4

CVE-2024-52364

IBM Cloud Pak for Business Automation cross-site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary …

IBM Cloud Pak for Business Automation

Feb 5, 2025
Medium 4.3

CVE-2024-49348

IBM Cloud Pak for Business Automation incorrect privilege assignment

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows restricting access to organizational data to valid contexts. The fact that tasks of type comment ca…

IBM Cloud Pak for Business Automation

Feb 5, 2025
Medium 4.0

CVE-2024-39338

Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

kubeflow-pipelines-apiserver lerna kubeflow-centraldashboard jitsucom-jitsu-console Debian Ubuntu Wolfi npm

Aug 9, 2024

Revision history

2025-02-09 #1
Initiale Fassung

References

IBM Security Bulletin 7182812 vom 2025-02-09
https://www.ibm.com/support/pages/node/7182812
IBM Security Bulletin 7182817 vom 2025-02-09
https://www.ibm.com/support/pages/node/7182817
IBM Security Bulletin 7182809 vom 2025-02-09
https://www.ibm.com/support/pages/node/7182809
IBM Security Bulletin 7182810 vom 2025-02-09
https://www.ibm.com/support/pages/node/7182810
IBM Security Bulletin 7182816 vom 2025-02-09
https://www.ibm.com/support/pages/node/7182816
IBM Security Bulletin 7182815 vom 2025-02-09
https://www.ibm.com/support/pages/node/7182815