Security readout for executives and security teams
Plain-English summary
This vulnerability lets an authenticated client alter who appears to have last modified a document in affected IBM workflow products. It does not expose data or disrupt service, but it can weaken audit trails and accountability for business documents.
Executive priority
Treat as a scheduled remediation item, not an emergency, unless affected systems support regulated approvals, legal records, or high-trust audit workflows. The main risk is loss of confidence in document accountability.
Technical view
CVE-2019-4045 is a missing API restriction in embedded document management features of IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0 through 18.0.0.2. CVSS 3.0 is 4.3: network-accessible, low complexity, low privileges, no user interaction, integrity impact only.
Likely exposure
Exposure is most likely where affected IBM workflow versions run document management features and authenticated users or clients can reach the relevant API. Systems relying on document metadata for audit, approval, or compliance evidence have higher business impact.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not listed as KEV. CVSS marks exploit code maturity as unproven. Abuse requires some level of authenticated access and appears limited to spoofing document last-modified metadata.
Researcher notes
No CWE, endpoint detail, or fixed build number is included in the supplied bundle. The key properties are authenticated network access, low attack complexity, and integrity-only impact. Use IBM advisory and X-Force as authoritative follow-up sources.
Mitigation direction
- Review IBM advisory 10870494 and apply the official vendor remediation.
- Inventory IBM Business Automation Workflow and Business Process Manager 18.0.0.0 through 18.0.0.2 deployments.
- Limit document management API access to trusted, necessary clients and roles.
- Review audit controls that depend on document last-modified-by metadata.
Validation and detection
- Confirm product name and version against the affected IBM release list.
- Verify whether embedded document management features are enabled and reachable.
- Check IBM X-Force entry 156241 for vendor context and remediation status.
- Review logs for suspicious document metadata changes by unexpected users.
- Run authorized regression tests confirming metadata is server-controlled after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-4045 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/S:U/UI:N/AC:L/C:N/A:N/PR:L/I:L/RC:C/RL:O/E:U
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/S:U/UI:N/AC:L/C:N/A:N/PR:L/I:L/RC:C/RL:O/E:U2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.3MediumVector: CVSS:3.0/AV:N/S:U/UI:N/AC:L/C:N/A:N/PR:L/I:L/RC:C/RL:O/E:U
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/docview.wss?uid=ibm10870494CVE reference · x_refsource_CONFIRM
- ibm-bpm-cve20194045-gain-access (156241)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.