description: IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
problem types: Obtain Information
affected:
{
product: Business Process Manager
vendor: IBM
versions:
status: affected, version: 8.5
status: affected, version: 8.6
}
{
product: Business Automation Workflow
vendor: IBM
versions:
status: affected, version: 18.0
status: affected, version: 19.0
status: affected, version: 20.0
status: affected, version: 21.0
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.0/PR:N/C:H/S:U/AV:N/UI:N/A:N/AC:H/I:N/RC:C/RL:O/E:U
version: 3.0
]