Vulnerability CVE-2020-4794 - CERT Civis.Net

Vulnerability Name:

CVE-2020-4794 (CCN-189445)

Assigned:

2019-12-30

Published:

2020-12-18

Updated:

2020-12-22

Summary:

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
4.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): Low

5.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
4.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): Partial

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2020-4794

Source: XF
Type: UNKNOWN
ibm-icp4a-cve20204794-input-validation(189445)

Source: XF
Type: VDB Entry, Vendor Advisory
ibm-icp4a-cve20204794-input-validation (189445)

Source: CCN
Type: IBM Security Bulletin 6359463 (Automation Workstream Services)
Information disclosure and Denial of Service vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-4794

Source: CONFIRM
Type: Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6359463

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:automation_workstream_services:19.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:automation_workstream_services:20.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:automation_workstream_services:20.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.6.1:*:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.6.1:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.6.0:-:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.6.0:-:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:express:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.6:*:*:*:standard:*:*:*

OR cpe:/a:ibm:business_process_manager:8.6:*:*:*:express:*:*:*

Configuration 2:

cpe:/a:ibm:business_automation_workflow:18.0.0.0:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:18.0.0.1:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:18.0.0.2:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.0:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.1:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.2:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.3:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.0:*:*:*:docker:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:-:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.2.0:*:*:*:-:*:*:*

Configuration CCN 1:

cpe:/a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:automation_workstream_services:19.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:automation_workstream_services:20.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:automation_workstream_services:20.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:18.0:*:*:*:*:*:*:*

Denotes that component is vulnerable