Cross-site request forgery in IBM Cloud Pak for Business Automation - CVE-2022-42435

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU70541

Cross-site request forgery in IBM Cloud Pak for Business Automation - CVE-2022-42435

Published: December 30, 2022


Vulnerability identifier: #VU70541
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-42435
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin within the IBM Business Automation Workflow. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


Affected software

IBM Cloud Pak for Business Automation
IBM Business Automation Workflow

How to mitigate CVE-2022-42435

Install updates from vendor's website.

IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.16, 22.0.1.6
IBM Business Automation Workflow - addressed in versions 21.0.3 IF016, 22.0.1 IF006

External References

Related Security Bulletins