CVE-2023-33858: Medium severity ibm cloud pak for business automation vulnerability
IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33858?
CVE-2023-33858 is considered a high severity vulnerability due to its potential for credential disclosure through cross-site scripting.
How do I fix CVE-2023-33858?
To fix CVE-2023-33858, upgrade to the latest patched version of IBM Cloud Pak for Business Automation as specified in the vendor's advisory.
Which versions of IBM Cloud Pak for Business Automation are affected by CVE-2023-33858?
CVE-2023-33858 affects IBM Cloud Pak for Business Automation versions up to V23.0.1-IF001, V21.0.3-IF023 and specified earlier versions.
What kind of attack does CVE-2023-33858 enable?
CVE-2023-33858 enables attackers to execute arbitrary JavaScript code in the Web UI, leading to potential credential theft.
Is user input affected by CVE-2023-33858?
Yes, CVE-2023-33858 allows users to inject malicious scripts through inputs, compromising user sessions in trusted environments.