CSI baseline CSI-CARD-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.
CardDemo: vulnerability assessment
In this document
Assessment baseline: 22 October 2026. No applicable CVE has been established. The inspected material identifies application paths and technology dependencies, but it does not establish the installed middleware versions, maintenance levels or notice conditions needed for an applicability decision. This report assigns zero CVEs and no CVSS score. It does not claim that CardDemo is vulnerability-free. CARD-SRC-01 CARD-SRC-05 CARD-SRC-06
What was assessed
The completed assessment examined retained source and configuration for the optional authorisation handler and account-maintenance path, compared the public documentation's candidate scenarios, and consulted official IBM API/configuration material. The external material explains MQ and CICS behaviour relevant to those paths. It is not a matched security advisory. CARD-SRC-02 CARD-SRC-03 CARD-SRC-04 CARD-SRC-08 CARD-SRC-09 CARD-SRC-10 CARD-SRC-11 CARD-SRC-12 CARD-SRC-13
No application execution, exploitability test or deployed-environment inspection forms part of this baseline. No separately recorded vulnerability-database search supports this assessment. The evidence register identifies the sources and the limits of the external reference coverage.
Findings relevant to security review
| Finding | Established evidence | Qualified consequence |
|---|---|---|
| CARD-FIND-01: Reply before IMS persistence | The source sends the reply before the subsequent write and selects MQ no-syncpoint options. IBM documentation supplies the API semantics. CARD-SRC-02 CARD-SRC-10 CARD-SRC-11 | Approval could be received while the later IMS write fails. Occurrence, deployment and downstream extent are unverified. This is a transaction-integrity review finding, not a CVE match. |
| CARD-FIND-02: Recovery prerequisites | The source requests rollback after a failed customer rewrite; the sample file definitions and IBM recovery guidance expose configuration dependencies. CARD-SRC-03 CARD-SRC-04 CARD-SRC-12 CARD-SRC-13 | Paired records could become inconsistent if the installed resources do not provide the required recovery. Actual recoverability and outcome remain unknown. |
| CARD-FIND-03: Installed identity gap | Exact installed releases and service levels are absent from the inspected material. CARD-SRC-05 CARD-SRC-06 | An affected-version range cannot be evaluated against this application yet. |
| CARD-FIND-04: Separate evidence editions | The retained source and the public PDF-derived documentation have separate provenance. CARD-SRC-01 CARD-SRC-07 CARD-SRC-14 | A scenario cannot become a verified requirement merely because its description resembles the inspected source path. |
The first two findings warrant specific integrity checks. The evidence does not establish a successful attack, a production failure, exposure to an attacker or a vulnerability severity rating.
The exact inventory needed for CVE matching
CARD-TEST-04 should produce one dated record for each relevant installed product. The record must contain enough information to evaluate the affected range and configuration conditions in an official notice:
| Required field | Why it is needed |
|---|---|
| Exact vendor product name and edition | Distinguishes the installed product from similarly named products or sample application labels. |
| Platform and installed release | Establishes which affected-product and affected-version conditions can be evaluated. |
| Maintenance, service and fix levels | Establishes whether the installed level falls before or after a notice's stated fix, where applicable. |
| Deployed application/build identity | Connects the installed dependency to the inspected handler or account-maintenance program. |
| Enabled optional modules and component mapping | Establishes whether the assessed authorisation extension and its dependencies are present in the environment. |
| Relevant effective configuration | Permits assessment of notice conditions against actual queue, transaction, database and file-resource settings. |
| Collection date and supporting evidence | Makes the match repeatable and prevents an undated inventory value from being treated as current. |
| Official notice identifier, affected range, conditions and fixed level | Supplies the external assertion that is to be tested against the installed facts. |
These are evidence requests, not populated inventory values. They apply to the relevant MQ, CICS, IMS, Db2, COBOL compiler and z/OS dependencies. The README's 1.0.0 label supplies none of their installed versions. CARD-SRC-05 CARD-SRC-06
How a future applicable notice would reach the application
A future notice must first match the installed product, release and conditions. Only then should its implications be traced through the recovered application relationships.
| If a matched notice affects… | Existing application relationship to examine | Candidate verification |
|---|---|---|
| MQ request/reply or transaction behaviour used by this handler | COPAUA0C receipt, correlation, reply visibility and the later IMS write. CARD-SRC-02 CARD-SRC-08 |
CARD-TEST-01, based on C13-13. CARD-SRC-09 |
| IMS persistence used by the optional authorisation path | The relationship between the received decision and summary/detail state. CARD-SRC-02 CARD-SRC-08 | CARD-TEST-01. CARD-SRC-09 |
| CICS recovery or file behaviour used by account maintenance | Account rewrite, customer rewrite, rollback request and effective recoverability. CARD-SRC-03 CARD-SRC-04 | CARD-TEST-02 and CARD-TEST-03. CARD-SRC-09 |
These are conditional routes for selecting checks; none is an assertion that a notice currently applies. A notice concerning a different feature would require its own application-path evidence.
Decision at this baseline
Proceed with the two bounded integrity reviews and collect the missing installed identity. Keep CVE, affected-version and fixed-release fields unassigned until an actual match is supported. Preserve the distinction between the retained source and public candidate scenarios through CARD-TEST-05. All five verification tasks remain not run. CARD-SRC-01 CARD-SRC-07 CARD-SRC-09 CARD-SRC-14
This Wayfinder CSI assessment is limited to the registered source set. Findings, inference, recommendations and evidence gaps remain distinct. It does not establish a completed migration, production suitability or functional equivalence.
Independent Harten analysis of AWS Samples CardDemo, a public demonstration application. No AWS endorsement is implied. Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. Apache 2.0 source licence. The source-licence reference does not establish the revision analysed by the retained reports.
Inspect the evidence and external lookups · Read the existing application documentation edition.