CVE-2009-4998

IBM FileNet P8 Application Engine 3.5.1-019 and 4.0.2.7-P8AE-FP007 - Security Policy Bypass in Workplace Component

Title source: llm
STIX 2.1

Description

The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-019 and 4.0.2.x before 4.0.2.7-P8AE-FP007, in certain FileTracker configurations, does not apply a security policy to the first document added during a session, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PJ36552

Scores

EPSS 0.0108
EPSS Percentile 61.6%

Details

CWE
CWE-264
Status published
Products (2)
ibm/filenet_p8_application_engine 3.5.1 (20 CPE variants)
ibm/filenet_p8_application_engine 4.0.2 (7 CPE variants)
Published Sep 20, 2010
Tracked Since Feb 18, 2026