6

CVE-2014-0908

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Business Process Manager Version 7.5.0.0
Ibm ≫ Business Process Manager Version 7.5.0.1
Ibm ≫ Business Process Manager Version 7.5.1.0
Ibm ≫ Business Process Manager Version 7.5.1.1
Ibm ≫ Business Process Manager Version 7.5.1.2
Ibm ≫ Business Process Manager Version 8.0.0.0
Ibm ≫ Business Process Manager Version 8.0.1.0
Ibm ≫ Business Process Manager Version 8.0.1.1
Ibm ≫ Business Process Manager Version 8.0.1.2
Ibm ≫ Business Process Manager Version 8.5.0.0
Ibm ≫ Business Process Manager Version 8.5.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.06% 0.6
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505
http://www-01.ibm.com/support/docview.wss?uid=swg21669330
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91870