Medium severity5.4NVD Advisory· Published Sep 5, 2019· Updated Jun 17, 2026
CVE-2019-4149
CVE-2019-4149
Description
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*range: >=18.0.0.0,<=18.0.0.2
- (no CPE)range: 18.0.0.0 - 18.0.0.2
- (no CPE)range: 18.0.0.0
cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201712:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*
- (no CPE)range: 8.6.0.0 - 8.6.0.0 Cumulative Fix 2018.03, 8.5.7.0 - 8.5.7.0 Cumulative Fix 2017.06, 8.5.6.0 - 8.5.6.0 CF2
- (no CPE)range: 8.6.0.0
Patches
Vulnerability mechanics
References
2- exchange.xforce.ibmcloud.com/vulnerabilities/158415nvdVDB EntryVendor Advisory
- www.ibm.com/support/docview.wssnvdVendor Advisory
News mentions
0No linked articles in our index yet.