Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-4204: IBM Business Automation Workflow Web UI can run malicious scripts

CVE-2019-4204 · published 7 years ago

Summary

Versions 18.0.0.0, 18.0.0.1, 18.0.0.2 and 19.0.0.1 of IBM Business Automation Workflow allow a user to place custom JavaScript into the web interface. This could change how the page works and may expose login information during an active session. Apply the latest security update from IBM or restrict web access until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	business_automation_workflow	>= 18.0.0.0, <= 19.0.0.1 `cpe:2.3:a:ibm:business_automation_workflow::::::::`
ibm	business_process_manager	8.5.7.0 8.6.0.0 `cpe:2.3:a:ibm:business_process_manager:8.5.7.0:::::::*`

Original advisory text

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125.

References

http://www.securityfocus.com/bid/108328
https://exchange.xforce.ibmcloud.com/vulnerabilities/159125 VDB Entry Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880499 Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published10 May 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-4204 · NVD

Track software like this

Free during beta