High severity8.2NVD Advisory· Published Aug 20, 2019· Updated Jun 17, 2026
CVE-2019-4424
CVE-2019-4424
Description
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:ibm:business_automation_workflow:*:*:*:*:*:*:*:*range: >=18.0.0.0,<=19.0.0.2
- (no CPE)range: 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2
- (no CPE)range: 18.0.0.0
cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*+ 13 more
- cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*range: >=7.5.0.0,<=7.5.1.2
- cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf01:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf02:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.06:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.09:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.12:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.03:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:-:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2017.12:*:*:-:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:-:*:*:*
Patches
Vulnerability mechanics
References
2- exchange.xforce.ibmcloud.com/vulnerabilities/162770nvdVDB EntryVendor Advisory
- www.ibm.com/support/docview.wssnvdVendor Advisory
News mentions
0No linked articles in our index yet.