CVE-2021-39046

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	Business Automation Workflow	18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.1; 19.0.0.2; 19.0.0.3; 20.0.0.1; 20.0.0.2; 21.0.2; 21.0.3
IBM	Business Process Manager	8.5; 8.6

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/214346VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6564387Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/214346VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6564387Patch, Vendor Advisory

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-390476.1IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability al CVE-2021-390485.5IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker CVE-2021-390497.8IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A loca CVE-2021-39057.5A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially e CVE-2021-390507.8IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A loca CVE-2021-390516.5IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of applica CVE-2021-390529.8IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. CVE-2021-390537.5IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information, caused by the improper h CVE-2021-390545.4IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the victim. By persuadin CVE-2021-390555.4IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed a CVE-2021-390566.5The IBM i 7.1, 7.2, 7.3, and 7.4 Extended Dynamic Remote SQL server (EDRSQL) could allow a remote authenticated user to send a specially cra CVE-2021-390578.1IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated att