IBM Cloud Pak for Automation CSV injection
Priority MEDIUM 44CWE-1236Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0077 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Cloud Pak for Automation | 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 | — | No fix listed | CNA |
- Cloud Pak for Automation VendorIBM Affected 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2 Fixed in — No fix listed CNA
CPE configurations NVD · 39
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:* | 18.0.0 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:* | 18.0.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:* | 18.0.2 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:* | 19.0.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:* | 20.0.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:* | 20.0.2 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:* | 20.0.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:*:*:*:*:*:*:* | 21.0.1 | Vulnerable | IBM |
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:* Versions 18.0.0 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.1:*:*:*:*:*:*:* Versions 18.0.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:* Versions 18.0.2 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:* Versions 19.0.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.2:*:*:*:*:*:*:* Versions 20.0.2 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:* Versions 20.0.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.1:*:*:*:*:*:*:* Versions 21.0.1 Vulnerable ·IBM
Show 29 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:*:*:*:*:*:*:* | 21.0.2 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:* | 21.0.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:* | 21.0.3 interim_fix_001 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:* | 21.0.3 interim_fix_002 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:* | 21.0.3 interim_fix_003 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:* | 21.0.3 interim_fix_004 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:* | 21.0.3 interim_fix_005 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:* | 21.0.3 interim_fix_006 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:* | 21.0.3 interim_fix_007 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:* | 21.0.3 interim_fix_008 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:* | 21.0.3 interim_fix_009 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:* | 21.0.3 interim_fix_010 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:* | 21.0.3 interim_fix_011 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:* | 21.0.3 interim_fix_012 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:* | 21.0.3 interim_fix_013 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:* | 21.0.3 interim_fix_014 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:* | 21.0.3 interim_fix_015 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:* | 21.0.3 interim_fix_016 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:* | 21.0.3 interim_fix_017 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:* | 21.0.3 interim_fix_018 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:* | 21.0.3 interim_fix_019 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:* | 21.0.3 interim_fix_020 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:* | 21.0.3 interim_fix_021 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:* | 21.0.3 interim_fix_022 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:* | 21.0.3 interim_fix_023 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:* | 22.0.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:* | 22.0.2 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:* | 23.0.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_001:*:*:*:*:*:* | 23.0.1 interim_fix_001 | Vulnerable | IBM |
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:* Versions 21.0.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_001:*:*:*:*:*:* Versions 21.0.3 interim_fix_001 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_002:*:*:*:*:*:* Versions 21.0.3 interim_fix_002 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_003:*:*:*:*:*:* Versions 21.0.3 interim_fix_003 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_004:*:*:*:*:*:* Versions 21.0.3 interim_fix_004 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_005:*:*:*:*:*:* Versions 21.0.3 interim_fix_005 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_006:*:*:*:*:*:* Versions 21.0.3 interim_fix_006 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_007:*:*:*:*:*:* Versions 21.0.3 interim_fix_007 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_008:*:*:*:*:*:* Versions 21.0.3 interim_fix_008 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_009:*:*:*:*:*:* Versions 21.0.3 interim_fix_009 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_010:*:*:*:*:*:* Versions 21.0.3 interim_fix_010 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_011:*:*:*:*:*:* Versions 21.0.3 interim_fix_011 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_012:*:*:*:*:*:* Versions 21.0.3 interim_fix_012 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_013:*:*:*:*:*:* Versions 21.0.3 interim_fix_013 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_014:*:*:*:*:*:* Versions 21.0.3 interim_fix_014 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_015:*:*:*:*:*:* Versions 21.0.3 interim_fix_015 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_016:*:*:*:*:*:* Versions 21.0.3 interim_fix_016 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_017:*:*:*:*:*:* Versions 21.0.3 interim_fix_017 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_018:*:*:*:*:*:* Versions 21.0.3 interim_fix_018 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_019:*:*:*:*:*:* Versions 21.0.3 interim_fix_019 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_020:*:*:*:*:*:* Versions 21.0.3 interim_fix_020 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_021:*:*:*:*:*:* Versions 21.0.3 interim_fix_021 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_022:*:*:*:*:*:* Versions 21.0.3 interim_fix_022 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:21.0.3:interim_fix_023:*:*:*:*:*:* Versions 21.0.3 interim_fix_023 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.1:*:*:*:*:*:*:* Versions 22.0.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:22.0.2:*:*:*:*:*:*:* Versions 22.0.2 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:-:*:*:*:*:*:* Versions 23.0.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:interim_fix_001:*:*:*:*:*:* Versions 23.0.1 interim_fix_001 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-35899
- 2026-10-03 Alias added: GHSA-w8ph-83jm-g88m
References
More IBM Cloud Pak For Business Automation vulnerabilities
- TI-2025-24685 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026. CVSS 3.1HIGH 8.1
- TI-2023-19756 IBM Cloud Pak for Automation authentication bypass CVSS 3.1MEDIUM 6.5
- TI-2023-17504 IBM Cloud Pak for Business Automation cross-site scripting CVSS 3.1HIGH 7.6
- TI-2025-24684 security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025. CVSS 3.1HIGH 7.4
- TI-2023-27851 IBM Cloud Pak for Business Automation information disclosure CVSS 3.1MEDIUM 6.5
- TI-2021-10515 IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation… CVSS 3.1MEDIUM 6.8
Sources
- CVE-2023-35899 · CVE Program
- CVE-2023-35899 · NVD
- FIRST EPSS
- GHSA-w8ph-83jm-g88m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences