CVEvulnerability
CVE-2014-4758
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-09-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL.
Affected configurations
• ibm business process manager 7.5.0.0
• ibm business process manager 7.5.0.1
• ibm business process manager 7.5.1.0
• ibm business process manager 7.5.1.1
• ibm business process manager 7.5.1.2
• ibm business process manager 8.0.0.0
• ibm business process manager 8.0.1.0
• ibm business process manager 8.0.1.1
• ibm business process manager 8.0.1.2
• ibm business process manager 8.5.0.0
• ibm business process manager 8.5.0.1
• ibm business process manager 8.5.5.0
• ibm websphere application server 7.2
• ibm websphere application server 7.2.0.1
• ibm websphere application server 7.2.0.2
• ibm websphere application server 7.2.0.3
• ibm websphere application server 7.2.0.4
• ibm websphere application server 7.2.0.5
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/60851 secunia.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50215 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21680795 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94485 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/60851 secunia.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50215 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21680795 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94485 exchange.xforce.ibmcloud.com