168 lines
11 KiB
JSON
168 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-12730",
|
|
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "ibm",
|
|
"dateReserved": "2026-06-19T15:59:20.718Z",
|
|
"datePublished": "2026-08-05T15:57:37.007Z",
|
|
"dateUpdated": "2026-08-05T17:59:18.166Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
|
"shortName": "ibm",
|
|
"dateUpdated": "2026-08-05T17:25:51.335Z"
|
|
},
|
|
"title": "Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"cweId": "CWE-297",
|
|
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "IBM",
|
|
"product": "Business Automation Workflow containers and traditional",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "26.0.0"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "25.0.0",
|
|
"lessThanOrEqual": "25.0.0 Interim Fix 005",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "24.0.1",
|
|
"lessThanOrEqual": "24.0.1 Interim Fix 007",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "24.0.0",
|
|
"lessThanOrEqual": "24.0.0 Interim Fix 009",
|
|
"versionType": "semver"
|
|
}
|
|
],
|
|
"cpes": [
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:26.0.0:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:25.0.0:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:25.0.0:interim_fix_005:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:24.0.1:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:24.0.1:interim_fix_007:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:24.0.0:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:business_automation_workflow_containers_and_traditional:24.0.0:interim_fix_009:*:*:*:*:*:*"
|
|
]
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.",
|
|
"supportingMedia": [
|
|
{
|
|
"type": "text/html",
|
|
"base64": false,
|
|
"value": "<p>IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.</p>"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://www.ibm.com/support/pages/node/7282596",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"patch"
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"format": "CVSS",
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "GENERAL"
|
|
}
|
|
],
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "HIGH",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"availabilityImpact": "NONE",
|
|
"baseSeverity": "LOW",
|
|
"baseScore": 3.8,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
|
|
}
|
|
}
|
|
],
|
|
"solutions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "IBM strongly recommends addressing the vulnerability now by upgrading.\n\nAffected Product(s)Version(s)Remediation / FixIBM Business Automation Workflow containersV26.0.0Apply container 26.0.0-IF001 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-26000-interim-fixes IBM Business Automation Workflow traditionalV26.0.0Apply traditional 26.0.0-IF001 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-26000-interim-fixes IBM Business Automation Workflow containersV25.0.0 - V25.0.0-IF005Apply container 25.0.0-IF006 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-25000-interim-fixes IBM Business Automation Workflow traditionalV25.0.0 - V25.0.0-IF005Apply traditional 25.0.0-IF006 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-25000-interim-fixes IBM Business Automation Workflow containersV24.0.1 - V24.0.1-IF007Apply container 24.0.1-IF008 https://www.ibm.com/support/pages/node/7183042 IBM Business Automation Workflow traditionalV24.0.1 - V24.0.1-IF007Apply traditional 24.0.1-IF008 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-24010-interim-fixes IBM Business Automation Workflow containersV24.0.0 - V24.0.0-IF009Apply container 24.0.0-IF010 https://www.ibm.com/support/pages/node/7159792 IBM Business Automation Workflow traditionalV24.0.0 - V24.0.0-IF009Apply traditional 24.0.0-IF010 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-24000-interim-fixes",
|
|
"supportingMedia": [
|
|
{
|
|
"type": "text/html",
|
|
"base64": false,
|
|
"value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading.</p><div><table><thead><tr><th>Affected Product(s)</th><th>Version(s)</th><th>Remediation / Fix</th></tr></thead><tbody><tr><td>IBM Business Automation Workflow containers</td><td>V26.0.0</td><td>Apply container <a href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-26000-interim-fixes\" rel=\"nofollow\">26.0.0-IF001</a></td></tr><tr><td>IBM Business Automation Workflow traditional</td><td>V26.0.0</td><td>Apply traditional <a href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-26000-interim-fixes\" rel=\"nofollow\">26.0.0-IF001</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V25.0.0 - V25.0.0-IF005</td><td>Apply container <a href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-25000-interim-fixes\" rel=\"nofollow\">25.0.0-IF006</a></td></tr><tr><td>IBM Business Automation Workflow traditional</td><td>V25.0.0 - V25.0.0-IF005</td><td>Apply traditional <a href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-25000-interim-fixes\" rel=\"nofollow\">25.0.0-IF006</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V24.0.1 - V24.0.1-IF007</td><td>Apply container <a href=\"https://www.ibm.com/support/pages/node/7183042\" rel=\"nofollow\">24.0.1-IF008</a></td></tr><tr><td>IBM Business Automation Workflow traditional</td><td>V24.0.1 - V24.0.1-IF007</td><td>Apply traditional <a href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-24010-interim-fixes\" rel=\"nofollow\">24.0.1-IF008</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V24.0.0 - V24.0.0-IF009</td><td>Apply container <a href=\"https://www.ibm.com/support/pages/node/7159792\" rel=\"nofollow\">24.0.0-IF010</a></td></tr><tr><td>IBM Business Automation Workflow traditional</td><td>V24.0.0 - V24.0.0-IF009</td><td>Apply traditional <a href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-24000-interim-fixes\" rel=\"nofollow\">24.0.0-IF010</a></td></tr></tbody></table></div>"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-08-05T17:59:02.663931Z",
|
|
"id": "CVE-2026-12730",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-08-05T17:59:18.166Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |