CVE-2017-1539

Опубликовано: 26 сент. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807.

Ссылки

http://www.ibm.com/support/docview.wss?uid=swg22007451
Patch
Vendor Advisory
http://www.securityfocus.com/bid/100967
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/130807
VDB Entry
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22007451
Patch
Vendor Advisory
http://www.securityfocus.com/bid/100967
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/130807
VDB Entry
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*

EPSS

Процентиль: 69%

0.00596

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-3xh8-3p84-p59c