Information disclosure in IBM Cloud Pak for Business Automation - CVE-2023-40691
Published: December 28, 2023
Vulnerability identifier: #VU84828
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-40691
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to gain access to potentially sensitive information.
The vulnerability exists due to the application reveals sensitive information contained in application configuration to developer and administrator users. A remote privileged user can gain unauthorized access to sensitive information on the system.
Affected software
IBM Cloud Pak for Business Automation
IBM Business Automation Workflow
IBM Business Automation Workflow
How to mitigate CVE-2023-40691
Install updates from vendor's website.
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.27, 23.0.1.5
IBM Business Automation Workflow - update to 23.0.1 IF005
IBM Business Automation Workflow - update to 23.0.1 IF005