IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 1

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm business automation workflow19.0.0.1 and later · up to 19.0.0.3 inclusive
• ibm business automation workflow21.0.1 and later · up to 21.0.3 inclusive
• ibm business automation workflow18.0.0.0
• ibm business automation workflow18.0.0.1
• ibm business automation workflow20.0.0.1
• ibm business automation workflow20.0.0.2
• ibm business process manager8.5.0.0 and later · up to 8.5.0.201706 inclusive
• ibm business process manager8.6.0.0 and later · up to 8.6.0.201803 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ibm). Independent of NVD's CPE analysis and usually ahead of it.

• IBM Business Automation Workflow

  • 18.0.0.0, 18.0.0.1, 19.0.0.1, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.3, 21.0.1affected

• IBM Business Process Manager

  • 8.6.0.0, 8.5.0.0, 8.5.0.201706, 8.6.0.201803affected

Other highest-scoring records for the same primary product.

• CVE-2018-1674IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection.
  36Monitor
• CVE-2022-42435IBM Business Automation Workflow cross-site request forgery
  35Monitor
• CVE-2018-2000IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute
  35Monitor
• CVE-2019-4424IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE
  33Monitor
• CVE-2022-43864IBM Business Automation Workflow information disclosure
  31Monitor
• CVE-2025-13096XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -
  28Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.