PT-2017-12981 · Ibm · Ibm Business Process Manager

Published 2017-09-25 · Updated 2017-09-28 · CVE-2017-1346

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 7.5 through 8.5

Description The issue allows a local user to read files temporarily stored in a folder during offline installs, within a short timespan.

Recommendations For versions 7.5 through 8.5, consider restricting access to the temporary folder used during offline installs to prevent unauthorized reading of files.

Fix

Race Condition

Information Disclosure

Weakness Enumeration

CWE-362

CWE-200

Related Identifiers

CVE-2017-1346

Affected Products

Ibm Business Process Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1346 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/126461 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22004654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1346 · Vendor Advisory
• http://securityfocus.com/bid/100964 · Note