First published: Tue Jan 24 2023(Updated: )
IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239427.
Credit: psirt@us.ibm.com
Affected Software | Affected Version | How to fix |
---|---|---|
IBM Business Automation Workflow | >=21.0.1<=21.0.3.1 | |
IBM Business Automation Workflow | =20.0.0.1 | |
IBM Business Automation Workflow | =20.0.0.2 | |
IBM Business Automation Workflow | =22.0.1 | |
IBM Business Automation Workflow | =22.0.2 | |
IBM Business Monitor | =8.5.5 | |
IBM Business Monitor | =8.5.6 | |
IBM Business Monitor | =8.5.7 | |
IBM Business Monitor | <=8.5.5 | |
IBM Business Monitor | <=8.5.6 | |
IBM Business Monitor | <=8.5.7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2022-43864 is high with a severity value of 7.5.
CVE-2022-43864 allows a remote attacker to traverse directories on the system, potentially allowing them to view arbitrary files.
IBM Business Automation Workflow versions 21.0.1 to 21.0.3.1, 20.0.0.1, 20.0.0.2, 22.0.1, and 22.0.2 are affected by CVE-2022-43864.
The IBM X-Force ID for CVE-2022-43864 is 239427.
To fix CVE-2022-43864 in IBM Business Automation Workflow, apply the necessary patches or updates provided by IBM.