CVE:CVE-2022-41735
CNNVD:CNNVD-202212-2650
IBM Business Process Manager（BPM）是美国国际商业机器（IBM）公司的一套综合的业务流程管理平台。该平台为业务的流程建模、组装、监控和部署提供了一系列的相关工具。
IBM Business Process Manager存在安全漏洞，该漏洞源于其允许用户在Web UI中嵌入任意JavaScript代码从而改变预期的功能可能导致可信会话中的凭证泄露。以下版本受到影响：21.0.1至21.0.3.1版本、20.0.0.1至20.0.0.2版本、19.0.0.1至19.0.0.3版本。
solution:Upgrade ibm business_automation_workflow to a higher version than 19.0.0.3,21.0.3.1,20.0.0.1,20.0.0.2,21.0.2,21.0.3,21.0.3:if002,21.0.3:if005,21.0.3:if006,21.0.3:if007,21.0.3:if008,21.0.3:if009,21.0.3:if010,21.0.3:if011,21.0.3:if012,21.0.3:if013,21.0.3:if014,22.0.1,22.0.1:if001,22.0.1:if002,22.0.1:if003,22.0.1:if004,and avoid the version [19.0.0.1,19.0.0.3],[21.0.1,21.0.3.1],20.0.0.1,20.0.0.2,21.0.2,21.0.3,21.0.3:if002,21.0.3:if005,21.0.3:if006,21.0.3:if007,21.0.3:if008,21.0.3:if009,21.0.3:if010,21.0.3:if011,21.0.3:if012,21.0.3:if013,21.0.3:if014,22.0.1,22.0.1:if001,22.0.1:if002,22.0.1:if003,22.0.1:if004