description: IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.
problem types: Obtain Information
affected:
{
product: Business Process Manager
vendor: IBM
versions:
status: affected, version: 8.5
status: affected, version: 8.6
}
{
product: Business Automation Workflow
vendor: IBM
versions:
status: affected, version: 18.0
status: affected, version: 19.0
status: affected, version: 20.0
}
{
product: Cloud Pak for Automation
vendor: IBM
versions:
status: affected, version: 20.0.3.IF002
status: affected, version: 21.0.1
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2.7
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.0/C:L/UI:N/S:U/AV:N/PR:L/I:N/AC:H/A:N/E:U/RL:O/RC:C
version: 3.0
]