IBM Alert
3072Warning Date
Severity Level
Warning Number
Target Sector
5 May, 2022
● High
2022-4777
All
IBM has released security updates to address several vulnerabilities in the following products:
- IBM Guardium Data Encryption (GDE) - Vormetric Data Security Manager (DSM)
- GDE Server 4.0.0.7 and lower
- IBM Robotic Process Automation for Cloud Pak
- < 21.0.2
- IBM Robotic Process Automation
- < 21.0.2
- IBM Business Automation Workflow
- V20.0
- V19.0
- V18.0
- IBM Business Process Manager
- V8.6
- V8.5
- V8.0
An attacker could exploit these vulnerabilities by doing the following:
- Denial of service attack (DoS)
- Information disclosure
- Cross-site scripting (XSS)
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-data-encryption-has-vulnerability-cve-2021-39020/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-may-affect-ibm-robotic-process-automation-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-automation-may-allow-regular-users-to-view-some-admin-pages/
- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vulnerabilities-in-jquery-might-affect-ibm-business-automation-workflow-and-ibm-business-process-manager-bpm-cve-2020-7656-cve-2020-11022-cve-2020-11023-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-automation-is-vulnerable-to-an-issue-where-an-api-could-be-used-to-perform-a-dns-lookup-via-a-third-party-provider/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-automation-could-allow-a-user-with-physical-access-to-create-an-api-request-modified-to-create-additional-objects-cve-2022-22434/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-may-affect-ibm-robotic-process-automation-4/
- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vulnerabilities-in-jquery-may-affect-ibm-business-automation-workflow-and-ibm-business-process-manager-bpm-cve-2020-11022-cve-2020-11023/