CVE-2014-0908 Information

Description

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2 8.0.x through 8.0.1.2 and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values which allows remote authenticated users to obtain sensitive information configure e-mail notifications or modify task assignments via REST API calls.

Reference

http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505 http://www-01.ibm.com/support/docview.wss?uid=swg21669330 https://exchange.xforce.ibmcloud.com/vulnerabilities/91870