CVE-2014-4802

IBM Business Process Manager 8.0-8.5.5 - Authenticated Information Disclosure via Saved Search Admin Component

Title source: llm
STIX 2.1

Description

The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by executing a saved search.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21684771
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95304

Scores

EPSS 0.0112
EPSS Percentile 62.7%

Details

CWE
CWE-264
Status published
Products (8)
ibm/business_process_manager 8.0.0.0
ibm/business_process_manager 8.0.1.0
ibm/business_process_manager 8.0.1.1
ibm/business_process_manager 8.0.1.2
ibm/business_process_manager 8.0.1.3
ibm/business_process_manager 8.5.0.0
ibm/business_process_manager 8.5.0.1
ibm/business_process_manager 8.5.5.0
Published Oct 07, 2014
Tracked Since Feb 18, 2026