NVD

Id
29744  
Name
CVE-2014-0908  
Description
The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-04-10  
Modified Date
2014-04-11  
Seq
2014-0908  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
157170 29744 CVE-2014-0908 JR49505  View
157171 29744 CVE-2014-0908 http://www-01.ibm.com/support/docview.wss?uid=swg21669330  View
157172 29744 CVE-2014-0908 ibm-bpm-cve20140908-priv-escalation(91870)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13112 JVNDB-2014-001987 IBM Business Process Manager のユーザ属性の実装における重要な情報を取得される脆弱性 IBM Business Process Manager (BPM) のユーザ属性の実装は、属性値の読み取り、または書き込みの認証を検証しないため、重要な情報を取得される、電子メール通知を設定される、およびタスクの割り当てを変更される脆弱性が存在します。 CVE-2014-0908 68309 CVE-2014-0908 29744 6 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001987.html 2014-04-04 2014-04-15 View