Vulnerability Bulletins |
IBM Security Bulletin: Missing authorization concept for document upload and download in IBM Business Process Manager (BPM) CMIS integration (CVE-2015-1904) |
|
| Affected software | IBM |
|
IBM Business Process Manager offers integration with external Enterprise Content Management (ECM) systems. If a process app is configured to always connect to an external ECM system using a predefined technical system account (rather than the actual end user), then the process app developer has no way of controlling access to upload or download functions for documents in the external ECM system. CVE(s): CVE-2015-1904 Affected product(s) and affected version(s): IBM Business Process More info: https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_missing_authorization_concept_for_document_upload_and_download_in_ibm_business_process_manager_bpm_cmis_integration_cve_2015_1904?lang=en_us |
|