APAR status
Closed as program error.
Error description
CVEID: CVE-2021-29753 Description: IBM Business Automation Workflow transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. CVSS Base Score: 5.9 CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/201919 for more information CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Local fix
Problem summary
No additional information is available. PRODUCTS AFFECTED IBM Business Process Manager (BPM) IBM Business Process Manager (BPM) Advanced IBM BPM Standard IBM BPM Express IBM Business Automation Workflow
Problem conclusion
A fix is available or will be available that prevents passwords in Servers and REST service bindings from being transmitted to a client browser.
Temporary fix
Comments
APAR Information
APAR number
JR63672
Reported component name
BUS AUTO WORKFL
Reported component ID
5737H4100
Reported release
J00
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2021-05-07
Closed date
2021-11-04
Last modified date
2021-11-04
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
JR63714
Fix information
Fixed component name
BUS AUTO WORKFL
Fixed component ID
5737H4100
Applicable component levels
[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS8JB4","label":"IBM Business Automation Workflow"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"19.0.0.1"}]
Document Information
Modified date:
05 November 2021