JR63612: SECURITY APAR CVE-2021-20448, CVE-2021-20549, CVE-2021-20550, CVE-2021-29714 - VULNERABILITIES WITH EMBEDDED NAVIGATOR

8.6.20020002-WS-BPM-WinX3264-IFJR63612
8.6.20020002-WS-BPM-MultiOS-IFJR63612
workflow.2102.delta.repository

APAR status

• Closed as program error.

Error description

• CVEID:   CVE-2021-20448
  DESCRIPTION:   IBM Content Navigator is vulnerable to cross-site
  scripting. This vulnerability allows users to embed arbitrary
  JavaScript code in the Web UI thus altering the intended
  functionality potentially leading to credentials disclosure
  within a trusted session.
  CVSS Base score: 5.4
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/196624 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID:   CVE-2021-20549
  DESCRIPTION:   IBM Content Navigator is vulnerable to cross-site
  scripting. This vulnerability allows users to embed arbitrary
  JavaScript code in the Web UI thus altering the intended
  functionality potentially leading to credentials disclosure
  within a trusted session.
  CVSS Base score: 5.4
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/199167 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID:   CVE-2021-20550
  DESCRIPTION:   IBM Content Navigator is vulnerable to cross-site
  scripting. This vulnerability allows users to embed arbitrary
  JavaScript code in the Web UI thus altering the intended
  functionality potentially leading to credentials disclosure
  within a trusted session.
  CVSS Base score: 5.4
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/199168 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID:   CVE-2021-29714
  DESCRIPTION:   IBM Content Navigator could allow a malicious
  user to cause a denial of service due to improper input
  validation.
  CVSS Base score: 6.5
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/200968 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
  

Local fix

Problem summary

• No additional information is available.
  

Problem conclusion

• A fix is available or will be available that resolves the
  multiple vulnerabilities with the embedded IBM Content Navigator
   in Business Automation Workflow.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUS AUTO WORKFL

• Fixed component ID

  5737H4100

Applicable component levels