PT-2014-6101 · Ibm · Ibm Business Process Manager

Published 2014-09-04 · Updated 2017-08-29 · CVE-2014-4759

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager (BPM) versions 8.5.x through 8.5.5

Description The issue allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results. This is due to an unspecified Ajax service in the Content Management toolkit.

Recommendations For versions 8.5.x through 8.5.5, consider restricting access to the document-attachment search functionality until a fix is available. As a temporary workaround, limit the ability to read document properties in search results to minimize the risk of sensitive information disclosure.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-4759

Affected Products

Ibm Business Process Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-4759 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21680809 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94486 · Note