CVE-2014-6139 - The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter

Back Back to CVE browser

MEDIUM

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter

Published Feb 13, 2015

4.0

MEDIUM

CVSS 2.0

EPSS 1.00%

Description

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (1)

http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391
vendor-advisoryx_refsource_AIXAPARPatchVendor Advisory

Link	Providers	Tags
http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391		vendor-advisoryx_refsource_AIXAPARPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Feb 13, 2015

Updated Aug 6, 2024

Reserved Sep 2, 2014

Link CVE-2014-6139

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-6139

Red Hat

Severity n/a

Public date n/a

Links CVE-2014-6139