CVE-2014-4802

Опубликовано: 07 окт. 2014

Источник: nvd

CVSS2: 4

EPSS Низкий

Описание

The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by executing a saved search.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21684771
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95304
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21684771
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95304

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 37%

0.00159

Низкий

4 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-f2jg-q6x8-qc8m

github

больше 3 лет назад