CVE-2020-4446

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
IBM	Business Process Manager Standard	8.5.5; 8.5.7.CF201706; 8.5.7.CF201703; 8.5.7.CF201612; 8.5.7.CF201609; 8.5.7.CF201606; 8.5.7; 8.5.6.2; 8.5.6.1; 8.5.6; 8.6; 8.5.0.2; 8.5.0.1; 8.5; 8.0.1.3; 8.0.1.2; 8.0.1.1; 8.0.1; 8.0
IBM	Business Automation Workflow	18.0.0.0; 19.0.0.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181126VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6205805Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/181126VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6205805Vendor Advisory

Timeline

Published: May 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-44475.4IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc CVE-2020-44489.8IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the sy CVE-2020-44497.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a spe CVE-2020-44509.8IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specia CVE-2020-44527.5IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h CVE-2020-44599.8IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound CVE-2020-44616.5IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation CVE-2020-44628.2IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 ar CVE-2020-44638.2IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r CVE-2020-44648.8IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with CVE-2020-44656.5IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an err CVE-2020-44666.5IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within th