CVE-2021-29859: Medium severity IBM Cloud Pak for Business Automation vulnerability

Published Apr 29, 2022

Updated

IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081.

Other sources

IBM ICP4A - User Management System Component could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out.

Affected Software

27 affected components

IBM Cloud Pak for Business Automation=21.0.1

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_001

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_002

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_003

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_004

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_005

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_006

IBM Cloud Pak for Business Automation=21.0.1-interim_fix_007

IBM Cloud Pak for Business Automation=21.0.2

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_001

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_002

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_003

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_004

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_005

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_006

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_007

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_008

IBM Cloud Pak for Business Automation=21.0.2-interim_fix_009

IBM Cloud Pak for Business Automation=21.0.3

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_001

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_002

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_003

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_004

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_005

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_006

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_007

IBM Cloud Pak for Business Automation=21.0.3-interim_fix_008

Event History

Apr 29, 2022

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionSeverityAffected Software

May 2, 2022

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6578583

Frequently Asked Questions

What is CVE-2021-29859?

CVE-2021-29859 is a vulnerability in the User Management System Component of IBM Cloud Pak for Business Automation that allows a user with physical access to the system to perform unauthorized actions or obtain sensitive information.

What is the severity of CVE-2021-29859?

The severity of CVE-2021-29859 is medium with a score of 6.8.

Which versions of IBM Cloud Pak for Business Automation are affected by CVE-2021-29859?

IBM Cloud Pak for Business Automation versions 21.0.1 through 21.0.1-IF007, 21.0.2 through 21.0.2-IF009, and 21.0.3 through 21.0.3-IF008 are affected by CVE-2021-29859.

How can an attacker exploit CVE-2021-29859?

An attacker with physical access to the system can exploit CVE-2021-29859 to perform unauthorized actions or obtain sensitive information.

Where can I find more information about CVE-2021-29859?

You can find more information about CVE-2021-29859 on the IBM X-Force Exchange website and the IBM Support page.