CVE-2014-4759

Published: Sep 4, 2014Modified: May 6, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results.

Affected (3)

Products: Ibm: Business Process Manager

1 product

Business Process Manager

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ibm Business Process Manager	Version 8.5.0.0
Ibm Business Process Manager	Version 8.5.0.1
Ibm Business Process Manager	Version 8.5.5.0

Related CWEs

References (6)

http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21680809

Source: psirt@us.ibm.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/94486

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21680809

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/94486

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.