IBM addresses long-standing critical flaw in Business Automation Workflow
Take action: If you are running IBM Business Automation Workflow, time to prepare this for the next patching round. As the flaw has been around for years, it's not as if it's going to be attacked immediately. But give it a couple of months and there will be exploits. So run the regular patch and don't ignore this.
Learn More
IBM has addressed a long-standing critical vulnerability in its Business Automation Workflow software, caused by an outdated version of the Dojo JavaScript library.
The vulnerability, tracked as CVE-2021-23450 (CVSS score 9.8) allowed for arbitrary code injection and had remained unpatched in certain versions of the software until now.
The Dojo library vulnerability was first identified in 2021, and IBM had initially warned users about the potential risk, listing Business Automation Workflow as an impacted product. IBM has now released a comprehensive fix for both traditional and containerized versions of the software.
To mitigate this security risk, IBM advises the following updates:
- Containerized Versions (20.0.0.x, 21.0.x, 22.0.x, 23.0.x): Upgrade to either version 21.0.3-IF037 or the latest version 24.0.0-IF003.
- Traditional Version (21.0.3.1): Apply hotfix DT394647.
- Traditional Versions (18 through 23): IBM recommends replacing these older environments to ensure full mitigation.
