178 lines
9.6 KiB
JSON
178 lines
9.6 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-12758",
|
|
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "ibm",
|
|
"dateReserved": "2026-06-19T20:19:08.969Z",
|
|
"datePublished": "2026-09-14T21:15:24.700Z",
|
|
"dateUpdated": "2026-09-15T17:31:46.140Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
|
"shortName": "ibm",
|
|
"dateUpdated": "2026-09-14T21:15:24.700Z"
|
|
},
|
|
"title": "Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"cweId": "CWE-862",
|
|
"description": "CWE-862 Missing Authorization",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "IBM",
|
|
"product": "Cloud Pak for Business Automation",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "26.0.0",
|
|
"lessThanOrEqual": "26.0.0 Interim Fix 001",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "25.0.0",
|
|
"lessThanOrEqual": "25.0.0 Interim Fix 005",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "24.0.1",
|
|
"lessThanOrEqual": "24.0.1 Interim Fix 008",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"status": "affected",
|
|
"version": "24.0.0",
|
|
"lessThanOrEqual": "24.0.0 Interim Fix 009",
|
|
"versionType": "semver"
|
|
}
|
|
],
|
|
"cpes": [
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:26.0.0:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:26.0.0:interim_fix_001:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:interim_fix_005:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_008:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
|
|
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_009:*:*:*:*:*:*"
|
|
]
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.",
|
|
"supportingMedia": [
|
|
{
|
|
"type": "text/html",
|
|
"base64": false,
|
|
"value": "<p>IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.</p>"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://www.ibm.com/support/pages/node/7285931",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"patch"
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"format": "CVSS",
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "GENERAL"
|
|
}
|
|
],
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"availabilityImpact": "NONE",
|
|
"baseSeverity": "MEDIUM",
|
|
"baseScore": 5.4,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
|
|
}
|
|
}
|
|
],
|
|
"solutions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "IBM strongly recommends addressing the vulnerability now.\n\n\n\nAffected Product(s)Version(s)Remediation / FixIBM Cloud Pak for Business AutomationV26.0.0 - V26.0.0-IF001Apply security fix 26.0.0-IF002 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2600-if002 IBM Cloud Pak for Business AutomationV25.0.0 - V25.0.0-IF005Apply security fix 25.0.0-IF006 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2500-if006 IBM Cloud Pak for Business AutomationV24.0.1 - V24.0.1-IF008Apply security fix 24.0.1-IF009 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2401-if009 IBM Cloud Pak for Business AutomationV24.0.0 - V24.0.0-IF009Apply security fix 24.0.0-IF010 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2400-if010 \n\n\n\nAny open source library may be included in one or more sub-components of IBM Cloud Pak for Business Automation. Open source updates are not always synchronized across all components.",
|
|
"supportingMedia": [
|
|
{
|
|
"type": "text/html",
|
|
"base64": false,
|
|
"value": "<div><p>IBM strongly recommends addressing the vulnerability now.</p></div><div><table><thead><tr><td>Affected Product(s)</td><td>Version(s)</td><td>Remediation / Fix</td></tr></thead><tbody><tr><td>IBM Cloud Pak for Business Automation</td><td>V26.0.0 - V26.0.0-IF001</td><td>Apply security fix <a href=\"https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2600-if002\" rel=\"nofollow\">26.0.0-IF002</a></td></tr><tr><td>IBM Cloud Pak for Business Automation</td><td>V25.0.0 - V25.0.0-IF005</td><td>Apply security fix <a href=\"https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2500-if006\" rel=\"nofollow\">25.0.0-IF006</a></td></tr><tr><td>IBM Cloud Pak for Business Automation</td><td>V24.0.1 - V24.0.1-IF008</td><td>Apply security fix <a href=\"https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2401-if009\" rel=\"nofollow\">24.0.1-IF009</a></td></tr><tr><td>IBM Cloud Pak for Business Automation</td><td>V24.0.0 - V24.0.0-IF009</td><td>Apply security fix <a href=\"https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2400-if010\" rel=\"nofollow\">24.0.0-IF010</a></td></tr></tbody></table></div><p>Any open source library may be included in one or more sub-components of IBM Cloud Pak for Business Automation. Open source updates are not always synchronized across all components. </p>"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Vinayachandran.Sasidharan@ibm.com",
|
|
"type": "finder"
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-12758",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-09-15T17:19:49.015004Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-09-15T17:31:46.140Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |