CVE-2021-38893

Katalog CVE

CVSS 5.4 · Medium EPSS 0,69%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ibm business automation workflow, ibm business process manager +1 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.

Rincian

Terbit di NVD

21 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exchange.xforce.ibmcloud.com/vulnerabilities/209512 vdb entry · advisory vendor
• https://www.ibm.com/support/pages/node/6526488 advisory vendor
• https://www.ibm.com/support/pages/node/6527782 patch · advisory vendor