VulnerabilityModified
CVE-2014-4759
An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading…
MEDIUM 4.0EPSS 1.08%
Does this matter?
Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own.
Description
An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- ibm/business process manager
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21680809Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94486
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21680809Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94486
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.