PT-2014-5078 · Ibm · Ibm Business Process Manager+1

Published 2014-08-17 · Updated 2017-08-29 · CVE-2014-3087

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager (BPM) versions 7.5 through 8.5.5 WebSphere Lombardi Edition versions 7.2 through 7.2.0.5

Description The issue allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This occurs in the callService.do endpoint.

Recommendations For IBM Business Process Manager (BPM) versions 7.5 through 8.5.5, consider restricting access to the callService.do endpoint until a fix is available. For WebSphere Lombardi Edition versions 7.2 through 7.2.0.5, consider disabling the XML external entity processing in the callService.do endpoint as a temporary workaround.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3087

Affected Products

Ibm Business Process Manager

Websphere Lombardi Edition

References · 9

• http://www-01.ibm.com/support/docview.wss?uid=swg21679726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3087 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616 · Vendor Advisory
• http://secunia.com/advisories/60757 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3087 · Note
• http://securityfocus.com/bid/69264 · Note
• http://secunia.com/advisories/60752 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94112 · Note
• http://secunia.com/advisories/60755 · Note