Cross-site request forgery in IBM Business Process Manager and IBM Business Automation Workflow - CVE-2022-22361
Published: June 21, 2022
Vulnerability identifier: #VU64527
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22361
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and execute malicious and unauthorized actions transmitted from a user that the website trusts.
Affected software
IBM Business Process Manager
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
How to mitigate CVE-2022-22361
Install updates from vendor's website.
IBM Business Process Manager - update to 8.5.7 CF2017.06
IBM Business Automation Workflow - addressed in versions 19.0.0.3, 20.0.0.2, 21.0.2-IF011, 21.0.3, 21.0.3-IF010
IBM Business Automation Workflow - addressed in versions 19.0.0.3, 20.0.0.2, 21.0.2-IF011, 21.0.3, 21.0.3-IF010