Security readout for executives and security teams
Plain-English summary
This is a stored cross-site scripting flaw in IBM workflow products. An authenticated user could save JavaScript into the web interface, causing trusted users’ sessions to behave unexpectedly and potentially exposing credentials. It is not listed as CISA KEV, but it affects business process platforms that may handle sensitive operational data.
Executive priority
Treat as a moderate-priority remediation item. It is not proven actively exploited in the provided sources, but it affects trusted workflow systems and could expose credentials or alter business process UI behavior.
Technical view
CVE-2021-38893 affects IBM Business Process Manager 8.5/8.6, IBM Business Automation Workflow 18.0-21.0, and listed IBM Cloud Pak for Automation/BPM Standard versions. The CVSS 3.0 score is 6.4 with low privileges, network access, low complexity, changed scope, and low confidentiality/integrity impact.
Likely exposure
Exposure is most likely where affected IBM workflow web UIs are reachable by internal users, partners, or externally authenticated users. Risk increases if low-privileged accounts can create or edit content viewed by higher-value users.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The provided CVSS vector includes high exploit maturity, but available evidence only supports stored XSS risk, not confirmed in-the-wild exploitation.
Researcher notes
Avoid assuming affected versions beyond the source bundle. Key unknowns are the exact vulnerable input locations and fixed levels in each IBM advisory. Focus validation on version exposure, authenticated content-editing paths, and whether stored UI content is sanitized after remediation.
Mitigation direction
- Identify deployments of the affected IBM product versions listed in the sources.
- Review the linked IBM advisories for the exact supported fix or upgrade path.
- Restrict access to affected web UIs to trusted networks and users where possible.
- Reduce privileges for users who can create or edit shared UI content.
- Monitor for suspicious stored content changes in workflow UI fields.
Validation and detection
- Inventory IBM BPM, Business Automation Workflow, and Cloud Pak for Automation versions.
- Confirm whether affected web interfaces are reachable from untrusted networks or partner access paths.
- Check IBM advisory guidance against installed fix packs or product levels.
- Review application audit logs for unexpected edits to shared UI content.
- Validate that remediation status is documented for each affected environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38893 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/I:L/PR:L/C:L/S:C/UI:N/AC:L/AV:N/A:N/RC:C/RL:O/E:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/I:L/PR:L/C:L/S:C/UI:N/AC:L/AV:N/A:N/RC:C/RL:O/E:H3.12.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.4MediumVector: CVSS:3.0/I:L/PR:L/C:L/S:C/UI:N/AC:L/AV:N/A:N/RC:C/RL:O/E:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/6527782CVE reference · x_refsource_CONFIRM
- https://www.ibm.com/support/pages/node/6526488CVE reference · x_refsource_CONFIRM
- ibm-baw-cve202138893-xss (209512)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.