Vulnerability Bulletins |
IBM Security Bulletin: Injection vulnerabilities in WebSphere Lombardi Edition and IBM Business Process Manager (BPM) (CVE-2014-3087) |
|
| Affected software | IBM |
|
Service inputs can be passed into callService.do as URL parameters in an XML format. Because of insufficient input validation, XML injection attacks are possible. CVE(s): CVE-2014-3087 Affected product(s) and affected version(s): IBM Business Process Manager Express Versions 7.5, 8.0, and 8.5 IBM Business Process Manager Standard Versions 7.5, 8.0, and 8.5 IBM Business Process Manager Advanced Versions 7.5, 8.0, and 8.5 IBM WebSphere Lombardi Edition Version 7.2 Refer to the More info: https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_injection_vulnerabilities_in_websphere_lombardi_edition_and_ibm_business_process_manager_bpm_cve_2014_3087?lang=en_us |
|