Skip to content
OpenAdvisories
Unscored CVE-2014-0908 EUVD-2014-0938GHSA-9qv4-6j6x-7jx5

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5…

Published Apr 10, 2014 · Updated Aug 6, 2024 · Assigned by ibm

Description

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.

References