CVE-2024-38321

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38321
IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 Broken Link
https://www.ibm.com/support/pages/node/7162334 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if029:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if030:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if031:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if032:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if033:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if034:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:containers:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:enterprise_service_bus:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*
History

06 Sep 2024, 14:50

Type Values Removed Values Added
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/294868 - Broken Link
References () https://www.ibm.com/support/pages/node/7162334 - () https://www.ibm.com/support/pages/node/7162334 - Vendor Advisory
First Time Ibm
Ibm business Automation Workflow
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if033:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:enterprise_service_bus:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:22.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:22.0.1:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if016:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:enterprise_service_bus:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:-:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if008:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if011:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if009:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if007:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if030:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:23.0.1:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if031:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if014:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if006:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if029:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if015:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if032:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if012:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if013:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if010:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if002:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if017:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if028:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if034:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:23.0.2:*:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:21.0.3:if005:*:*:containers:*:*:*
cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:traditional:*:*:*

05 Aug 2024, 12:41

Type Values Removed Values Added
Summary
  • (es) IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2 y 24.0.0 almacena información potencialmente confidencial en archivos de registro en determinadas situaciones que un usuario autenticado podría leer. ID de IBM X-Force: 284868.

03 Aug 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-03 14:15

Updated : 2024-09-06 14:50

NVD link : CVE-2024-38321

Mitre link : CVE-2024-38321

CVE.ORG link : CVE-2024-38321

JSON object : View

Products Affected

ibm

  • business_automation_workflow
CWE
CWE-532

Insertion of Sensitive Information into Log File