Page 15 of 71 results (0.008 seconds)

CVSS: 6.0EPSS: 0%CPEs: 11EXPL: 0

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls. La implementación User Attribute en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.2 y 8.5.x hasta 8.5.0.1 no verifica autorización para acceso de lectura o escritura a valores de atributo, lo que permite a usuarios remotos autenticados obtener información sensible, configurar notificaciones de e-mail o modificar asignaciones de tareas a través de llamadas REST API. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505 http://www-01.ibm.com/support/docview.wss?uid=swg21669330 https://exchange.xforce.ibmcloud.com/vulnerabilities/91870 • CWE-264: Permissions, Privileges, and Access Controls •