Vulnerability in IBM Business Process Manager

CVE-2015-1905

The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors.

EPSS: 0.015 (71.5th percentile) — read the EPSS interpretation.

Affected products

Ibm Business_process_manager — versions 7.5.0.0, 7.5.0.1, 7.5.1.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

psirt@us.ibm.com (vdb-entry, x_refsource_BID)
psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
psirt@us.ibm.com (vendor-advisory, Patch, Vendor Advisory, x_refsource_AIXAPAR)
psirt@us.ibm.com (vdb-entry, x_refsource_SECTRACK)