CVE-2020-4490
CVE-2020-4490 is a medium-severity vulnerability in Ibm Business Automation Workflow with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 6.1)
- CVSS v2: 5.8
- EPSS exploit prediction: 1% (54th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Ibm Business Automation Workflow
- Published:
- Last modified:
Description
IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989
Frequently asked questions
- What is CVE-2020-4490?
- IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989
- How severe is CVE-2020-4490?
- CVE-2020-4490 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2020-4490 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-4490?
- CVE-2020-4490 primarily affects Ibm Business Automation Workflow. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-4490?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2020-4490 published?
- CVE-2020-4490 was published on 2020-05-29 and last updated on 2026-06-17.
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/181989
- https://www.ibm.com/support/pages/node/6217550
Affected products (5)
- cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_automation_workflow:19.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*
More vulnerabilities in Ibm Business Automation Workflow
- CVE-2019-4424 — High (CVSS 8.2): IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External…
- CVE-2022-43864 — High (CVSS 7.5): IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An…
- CVE-2025-13096 — High (CVSS 7.1): IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 -…
- CVE-2022-22361 — Medium (CVSS 6.5): IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through…
- CVE-2021-38900 — Medium (CVSS 6.5): IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a…
- CVE-2019-4669 — Medium (CVSS 6.3): IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business…