PT-2014-6101 · Ibm · Ibm Business Process Manager

Publicado 2014-09-04 · Atualizado 2017-08-29 · CVE-2014-4759

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager (BPM) versions 8.5.x through 8.5.5

Description The issue allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results. This is due to an unspecified Ajax service in the Content Management toolkit.

Recommendations For versions 8.5.x through 8.5.5, consider restricting access to the document-attachment search functionality until a fix is available. As a temporary workaround, limit the ability to read document properties in search results to minimize the risk of sensitive information disclosure.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-4759

Produtos afetados

Ibm Business Process Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-4759 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21680809 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94486 · Nota