Security Bulletin: Information disclosure in IBM Business Process Manager (BPM) V8.5 document attachments search (CVE-2014-4759)

Summary

IBM BPM document attachment queries can return document properties that contain sensitive information.

Vulnerability Details

CVE ID:CVE-2014-4759

DESCRIPTION:
An Ajax service that is shipped with the Content Management toolkit allows users to search for IBM BPM document attachments from the Document List coach control. The service can be invoked by authenticated users and accepts any document query as input. Users might invoke the service with a query that returns all documents including associated document properties.

Note: Listing all available documents is a valid usage scenario for the service. Access to document content is restricted so that only users that are authorized to work with a process instance can view contents of documents that are attached to this process instance. However, customers might store sensitive information in document properties. Therefore, customer-defined document properties must not be returned by the default search service.

**CVSS: *CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94486 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N)

Affected Products and Versions

• IBM Business Process Manager Standard V8.5.x
• IBM Business Process Manager Express V8.5.x
• IBM Business Process Manager Advanced V8.5.x

Note. The query feature is only available for customers with the IBM BPM document store feature configured. This feature is configured, by default, unless one of the following limitations applies:

• 8.5.0.x: Limitations in administering the IBM BPM document store
• 8.5.5.x: Limitations in administering the IBM BPM document store

Remediation/Fixes

Install interim fix JR50871 as appropriate for your current IBM Business Process Manager or WebSphere Lombardi Edition version.

• IBM Business Process Manager Express
• IBM Business Process Manager Standard
• IBM Business Process Manager Advanced

Workarounds and Mitigations

None