IBM Support

Security Bulletin: Information disclosure in IBM Business Process Manager (BPM) V8.5 document attachments search (CVE-2014-4759)

Security Bulletin


IBM BPM document attachment queries can return document properties that contain sensitive information.

Vulnerability Details

CVE ID: CVE-2014-4759
An Ajax service that is shipped with the Content Management toolkit allows users to search for IBM BPM document attachments from the Document List coach control. The service can be invoked by authenticated users and accepts any document query as input. Users might invoke the service with a query that returns all documents including associated document properties.

Note: Listing all available documents is a valid usage scenario for the service. Access to document content is restricted so that only users that are authorized to work with a process instance can view contents of documents that are attached to this process instance. However, customers might store sensitive information in document properties. Therefore, customer-defined document properties must not be returned by the default search service.

CVSS Base Score: 3.5
CVSS Temporal Score: See for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:N)

Affected Products and Versions

  • IBM Business Process Manager Standard V8.5.x
  • IBM Business Process Manager Express V8.5.x
  • IBM Business Process Manager Advanced V8.5.x

Note. The query feature is only available for customers with the IBM BPM document store feature configured. This feature is configured, by default, unless one of the following limitations applies:


Install interim fix JR50871 as appropriate for your current IBM Business Process Manager or WebSphere Lombardi Edition version.

  • IBM Business Process Manager Express
  • IBM Business Process Manager Standard
  • IBM Business Process Manager Advanced
  • Workarounds and Mitigations


    Get Notified about Future Security Bulletins


    Complete CVSS v2 Guide
    On-line Calculator v2

    Related information

    IBM Secure Engineering Web Portal
    IBM Product Security Incident Response Blog

    *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.


    According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

    Cross reference information
    Segment Product Component Platform Version Edition
    Business Integration IBM Business Process Manager Express Security Linux, Linux zSeries, Windows 8.5.5,, 8.5
    Business Integration IBM Business Process Manager Standard Security AIX, Linux, Linux zSeries, Solaris, Windows 8.5.5,, 8.5

    Product Alias/Synonym


    Document information

    More support for: IBM Business Process Manager Advanced

    Software version: 8.5,, 8.5.5

    Operating system(s): AIX, Linux, Solaris, Windows

    Reference #: 1680809

    Modified date: 22 August 2014