CVE-2014-6139

IBM Business Process Manager 8.0.1.3, 8.5.0.1, 8.5.5.0 - Authenticated Access Control Bypass via Search REST API

Title source: llm
STIX 2.1

Description

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter.

References (1)

Core 1
Core References
Patch, Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391

Scores

EPSS 0.0100
EPSS Percentile 59.0%

Details

CWE
CWE-264
Status published
Products (3)
ibm/business_process_manager 8.0.1.3
ibm/business_process_manager 8.5.0.1
ibm/business_process_manager 8.5.5.0
Published Feb 13, 2015
Tracked Since Feb 18, 2026