CVE-2020-4794 Missing authorization in Automation Workstream Services
An authenticated user can obtain sensitive information or cause a denial of service due to improper authorization checks in IBM Business Automation products.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4794?
CVE-2020-4794 is a medium-severity missing authorization vulnerability in Ibm Business Automation Workflow, published on 21 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445.
Weakness: CWE-863
Which versions are affected by CVE-2020-4794?
It affects 3 products.
Products include Ibm Automation Workstream Services, Ibm Business Automation Workflow, Ibm Business Process Manager.
How do I fix CVE-2020-4794?
No fix has been published for CVE-2020-4794 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-4794 being exploited?
There is no known exploitation of CVE-2020-4794 in the wild and no public exploit code.
Sources
Also known as GHSA-jq8v-8c7p-26p2.