Security Bulletin: An information disclosure security vulnerability has been identified with the embedded Content Navigator component shipped with IBM Business Automation Workflow (CVE-2019-4679)

Security Bulletin

Summary

Some application server information (the operating system name and version, for example) is included in the response when users log into IBM Content Navigator.

Vulnerability Details

CVEID: CVE-2019-4679
DESCRIPTION: IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/171515 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

- IBM Business Automation Workflow V18.0.0.0 through V19.0.0.2

- IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03

- IBM Business Process Manager V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06

- IBM Business Process Manager V8.5.6.0 through V8.5.6.0 Cumulative Fix 2

- IBM Business Process Manager V8.5.5.0

- IBM Business Process Manager V8.5.0.0 through V8.5.0.2

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR JR61912 as soon as practical:

IBM Business Automation Workflow

For IBM Business Automation Workflow V18.0.0.0 through V19.0.0.3

· Upgrade to at least IBM Business Automation Workflow V19.0.0.3 as required by iFix and then apply iFix JR61912
--OR--
· Apply cumulative fix Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

For IBM Business Process Manager V8.6.0.0 through V8.6.0.0 CF 2018.03
· Apply the remediation, as the version of IBM Content Navigator used by ACCE in Business Process Manager is no longer in support.
--OR--
· Upgrade to Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

For IBM BPM V8.5.0.0 through V8.5.7.0 CF 2017.06
· Apply the remediation, as the version of IBM Content Navigator used by ACCE in Business Process Manager is no longer in support.
--OR--
· Upgrade to Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

Workarounds and Mitigations

IBM Business Process Manager does not embed IBM Content Navigator, but does embed Content Platform Engine which includes Administrator Console for Content Platform Engine (ACCE) application for administering the document store. To remediate this in Business Process Manager, restrict access to the Administation Console for Content Platform Engine (ACCE) application. Allow only limited administrators access to the ACCE application to administer the document store.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Change History

10 Mar 2020: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFPJS","label":"IBM Business Process Manager"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}],"Version":"8.6.0.CF201803, 8.6.0.CF201712, 8.6","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS8JB4","label":"IBM Business Automation Workflow"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SSFTDH","label":"IBM Business Process Manager Standard"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}],"Version":"8.5.7.CF201706, 8.5.7.CF201703, 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SSFTBX","label":"IBM Business Process Manager Express"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}],"Version":"8.6.0.CF201803, 8.6.0.CF201712, 8.6, 8.5.7.CF201706, 8.5.7.CF201703, 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SSFTN5","label":"IBM Business Process Manager Advanced"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}],"Version":"8.5.7.CF201706, 8.5.7.CF201703, 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Was this topic helpful?

Document Information

Modified date:
14 September 2022

Initial Publish date:
10 March 2020

UID

ibm15695203

Tips

Security Bulletin: An information disclosure security vulnerability has been identified with the embedded Content Navigator component shipped with IBM Business Automation Workflow (CVE-2019-4679)