Vulnerability Details CVE-2014-4758
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.7%
CVSS Severity
CVSS v2 Score 4.0
References
- http://secunia.com/advisories/60851
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50215
- http://www-01.ibm.com/support/docview.wss?uid=swg21680795
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94485
- http://secunia.com/advisories/60851
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50215
- http://www-01.ibm.com/support/docview.wss?uid=swg21680795
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94485
Products affected by CVE-2014-4758
-
cpe:2.3:a:ibm:business_process_manager:7.5.0.0
-
cpe:2.3:a:ibm:business_process_manager:7.5.0.1
-
cpe:2.3:a:ibm:business_process_manager:7.5.1.0
-
cpe:2.3:a:ibm:business_process_manager:7.5.1.1
-
cpe:2.3:a:ibm:business_process_manager:7.5.1.2
-
cpe:2.3:a:ibm:business_process_manager:8.0.0.0
-
cpe:2.3:a:ibm:business_process_manager:8.0.1.0
-
cpe:2.3:a:ibm:business_process_manager:8.0.1.1
-
cpe:2.3:a:ibm:business_process_manager:8.0.1.2
-
cpe:2.3:a:ibm:business_process_manager:8.5.0.0
-
cpe:2.3:a:ibm:business_process_manager:8.5.0.1
-
cpe:2.3:a:ibm:business_process_manager:8.5.5.0
-
cpe:2.3:a:ibm:websphere_application_server:7.2
-
cpe:2.3:a:ibm:websphere_application_server:7.2.0.1
-
cpe:2.3:a:ibm:websphere_application_server:7.2.0.2
-
cpe:2.3:a:ibm:websphere_application_server:7.2.0.3
-
cpe:2.3:a:ibm:websphere_application_server:7.2.0.4
-
cpe:2.3:a:ibm:websphere_application_server:7.2.0.5