Use of Client-Side Authentication in IBM Business Automation Workflow - CVE-2024-43188
Published: October 31, 2024
Vulnerability identifier: #VU99544
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-43188
CWE-ID: CWE-603
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a privileged user to perform unauthorized activities.
The vulnerability exists due to improper client side validation. A privileged user can perform unauthorized activities due to improper client side validation.
Affected software
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Cloud Pak for Business Automation
How to mitigate CVE-2024-43188
Install updates from vendor's website.
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003