PT-2017-10270 · Ibm · Ibm Business Process Manager

Nalla Muthu S + 1 · Published 2017-03-07 · Updated 2017-05-02 · CVE-2016-9693

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 7.5 through 8.5

Description The issue allows an attacker to cause an unauthenticated victim to download a malicious payload, potentially bypassing existing file type restrictions. This could lead to the payload being considered executable and causing damage on the victim's machine.

Recommendations For IBM Business Process Manager versions 7.5 through 8.5, consider restricting the file download capability until a fix is available. As a temporary workaround, restrict access to the file download feature to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-9693

Affected Products

Ibm Business Process Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9693 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9693 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=swg21998655 · Vendor Advisory
• http://securityfocus.com/bid/98074 · Note