CVE-2023-50959: IBM Cloud Pak for Business Automation information disclosure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-31 · updated 2026-06-17
Weakness: CWE-497

Description

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938.

Affected products

IBM Cloud Pak for Business Automation: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3 (+10)

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/275938
https://www.ibm.com/support/pages/node/7145492
https://exchange.xforce.ibmcloud.com/vulnerabilities/275938
https://www.ibm.com/support/pages/node/7145492

Get alerted when CVE-2023-50959 or the next vulnerability affects your stack