7.1
High
CVE-2021-20482 IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack…
Description
IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Pak for Automation 20.0 | 20.0.2 → 20.0.3.IF002 | No fix stated |
Other CVEs of Cloud Pak for Automation
The 11 CVEs of Cloud Pak for Automation →
CVE-2023-35899
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2,…
7.0
High
CVE-2023-38367
IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2,…
6.5
Medium
CVE-2021-29872
IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header…
5.4
Medium
CVE-2021-38966
IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting
5.4
Medium