CVE-2014-6139
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM Business Process Manager（BPM）是美国IBM公司的一套综合的业务流程管理平台。该平台为业务的流程建模、组装、监控和部署提供了一系列的相关工具。 IBM BPM的Search REST API中存在安全漏洞。远程攻击者可通过为‘filterByCurrentUser’参数指定错误的值利用该漏洞绕过既定的访问限制，执行task-instance和process-instance搜索操作。以下版本受到影响：IBM Business Process Manager 8.0.1.3
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2014-6139
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
IBM Business Process Manager Search REST API 权限许可和访问控制漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM Business Process Manager（BPM）是美国IBM公司的一套综合的业务流程管理平台。该平台为业务的流程建模、组装、监控和部署提供了一系列的相关工具。 IBM BPM的Search REST API中存在安全漏洞。远程攻击者可通过为‘filterByCurrentUser’参数指定错误的值利用该漏洞绕过既定的访问限制，执行task-instance和process-instance搜索操作。以下版本受到影响：IBM Business Process Manager 8.0.1.3
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2014-6139
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2014-6139
请登录查看更多情报信息。
Vendor Advisories for CVE-2014-6139 (1)
Same Patch Batch · n/a · 2015-02-13 · 20 CVEs total
| CVE-2014-4771 | IBM WebSphere MQ 资源管理错误漏洞 | |
| CVE-2015-0873 | PerlTreeBBS 跨站脚本漏洞 | |
| CVE-2015-0593 | Cisco IOS Zone-Based Firewall功能资源管理错误漏洞 | |
| CVE-2014-8909 | IBM WebSphere Portal 跨站脚本漏洞 | |
| CVE-2014-8385 | Advantech EKI-1200网关缓冲区溢出漏洞 | |
| CVE-2014-6185 | IBM Tivoli Storage Manager 权限许可和访问控制漏洞 | |
| CVE-2014-6154 | IBM Optim Performance Manager for DB2和InfoSphere Optim Performance Manager for DB2 目录遍历漏洞 | |
| CVE-2014-4813 | IBM Tivoli Storage Manager 竞争条件漏洞 | |
| CVE-2014-4803 | IBM Curam Social Program Management Universal Access组件CRLF注入漏洞 | |
| CVE-2014-4781 | IBM InfoSphere BigInsights alert模块信息泄露漏洞 | |
| CVE-2013-2027 | Jython 权限许可和访问控制漏洞 | |
| CVE-2015-0255 | X.Org X Server 信息泄露漏洞 | |
| CVE-2015-0245 | Red Hat D-Bus 本地拒绝服务漏洞 | |
| CVE-2014-8122 | Red Hat JBoss Weld 竞争条件漏洞 | |
| CVE-2014-7853 | Red Hat JBoss Enterprise Application Platform Application Server JacORB子系统安全漏洞 | |
| CVE-2014-7849 | Red Hat JBoss Enterprise Application Platform Role Based Access Control组件安全漏洞 | |
| CVE-2014-7827 | Red Hat JBoss Enterprise Application Platform Security 安全漏洞 | |
| CVE-2014-0154 | ovirt-engine 信息泄露漏洞 | |
| CVE-2014-0151 | Red Hat oVirt 跨站请求伪造漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2014-6139
No comments yet