CVE-2017-1539

HIGH

IBM Business Process Manager 7.5, 8.0, 8.5 - Privilege Escalation via LDAP Group Membership Manipulation

Title source: llm
STIX 2.1

Description

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/100967
Patch, Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg22007451
VDB Entry, Vendor Advisory x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/130807

Scores

CVSS v3 8.8
EPSS 0.0152
EPSS Percentile 71.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (30)
IBM/Business Process Manager Advanced 7.5
IBM/Business Process Manager Advanced 7.5.0.1
IBM/Business Process Manager Advanced 7.5.1
IBM/Business Process Manager Advanced 7.5.1.1
IBM/Business Process Manager Advanced 7.5.1.2
IBM/Business Process Manager Advanced 8.0
IBM/Business Process Manager Advanced 8.0.1
IBM/Business Process Manager Advanced 8.0.1.1
IBM/Business Process Manager Advanced 8.0.1.2
IBM/Business Process Manager Advanced 8.0.1.3
... and 20 more
Published Sep 26, 2017
Tracked Since Feb 18, 2026