Medium severity · published Dec 21, 2020
CVE-2020-4794
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated…
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Automation Workstream Services · Ibm
19.0.3; 20.0.1; 20.0.2 · source: NVD
BA
Business Automation Workflow · Ibm
18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 19.0.0.2; +4 more · source: NVD
BP
Business Process Manager · Ibm
8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.1; 8.0.1.1; +32 more · source: NVD