{"id":"CVE-2021-29751","state":"PUBLISHED","title":"IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another u","description":"IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.","publishedAt":"2021-06-28T15:55:25.283Z","updatedAt":"2024-09-17T02:47:11.003Z","severity":{"score":3.1,"label":"Low","version":"3.0","vector":"CVSS:3.0/C:L/UI:N/S:U/AV:N/PR:L/I:N/AC:H/A:N/E:U/RL:O/RC:C","source":"ibm"},"assigner":"ibm","products":["IBM Business Process Manager","IBM Business Automation Workflow","IBM Cloud Pak for Automation"],"affected":[{"vendor":"IBM","product":"Business Process Manager","versions":[{"version":"8.5","status":"affected"},{"version":"8.6","status":"affected"}]},{"vendor":"IBM","product":"Business Automation Workflow","versions":[{"version":"18.0","status":"affected"},{"version":"19.0","status":"affected"},{"version":"20.0","status":"affected"}]},{"vendor":"IBM","product":"Cloud Pak for Automation","versions":[{"version":"20.0.3.IF002","status":"affected"},{"version":"21.0.1","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6465127","https://www.ibm.com/support/pages/node/6467055","https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"],"weaknesses":[],"ingestedAt":"2026-10-29T19:48:21.578Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/29xxx/CVE-2021-29751.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-29751","state":"PUBLISHED","datePublished":"2021-06-28T15:55:25.283Z","dateUpdated":"2024-09-17T02:47:11.003Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2021-03-31T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779."}],"affected":[{"vendor":"IBM","product":"Business Process Manager","versions":[{"version":"8.5","status":"affected"},{"version":"8.6","status":"affected"}]},{"vendor":"IBM","product":"Business Automation Workflow","versions":[{"version":"18.0","status":"affected"},{"version":"19.0","status":"affected"},{"version":"20.0","status":"affected"}]},{"vendor":"IBM","product":"Cloud Pak for Automation","versions":[{"version":"20.0.3.IF002","status":"affected"},{"version":"21.0.1","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6465127","tags":["x_refsource_CONFIRM"]},{"url":"https://www.ibm.com/support/pages/node/6467055","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/201779","name":"ibm-baw-cve202129751-info-disc (201779)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","exploitCodeMaturity":"UNPROVEN","integrityImpact":"NONE","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":2.7,"temporalSeverity":"LOW","userInteraction":"NONE","vectorString":"CVSS:3.0/C:L/UI:N/S:U/AV:N/PR:L/I:N/AC:H/A:N/E:U/RL:O/RC:C","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2021-06-28T15:55:25.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2021-06-25T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2021-06-25T00:00:00","ID":"CVE-2021-29751","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Business Process Manager","version":{"version_data":[{"version_value":"8.5"},{"version_value":"8.6"}]}},{"product_name":"Business Automation Workflow","version":{"version_data":[{"version_value":"18.0"},{"version_value":"19.0"},{"version_value":"20.0"}]}},{"product_name":"Cloud Pak for Automation","version":{"version_data":[{"version_value":"20.0.3.IF002"},{"version_value":"21.0.1"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"H","AV":"N","C":"L","I":"N","PR":"L","S":"U","UI":"N"},"TM":{"E":"U","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/6465127","refsource":"CONFIRM","title":"IBM Security Bulletin 6465127 (Cloud Pak for Automation)","url":"https://www.ibm.com/support/pages/node/6465127"},{"name":"https://www.ibm.com/support/pages/node/6467055","refsource":"CONFIRM","title":"IBM Security Bulletin 6467055 (Business Automation Workflow)","url":"https://www.ibm.com/support/pages/node/6467055"},{"name":"ibm-baw-cve202129751-info-disc (201779)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6465127","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.ibm.com/support/pages/node/6467055","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/201779","name":"ibm-baw-cve202129751-info-disc (201779)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T22:18:02.690Z"}}]}}}