CVE-2017-1766: Medium severity ibm business process manager vulnerability
Published Mar 30, 2018
·Updated
Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151.
Affected Software
35 affected components
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.0-cf2
IBM Business Process Manager=8.5.6.1
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.7.0
IBM Business Process Manager=8.5.7.0-cf201606
IBM Business Process Manager=8.5.7.0-cf201609
IBM Business Process Manager=8.5.7.0-cf201612
IBM Business Process Manager=8.5.7.0-cf201703
IBM Business Process Manager=8.5.7.0-cf201706
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.0-cf2
IBM Business Process Manager=8.5.6.1
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.7.0
IBM Business Process Manager=8.5.7.0-cf201606
IBM Business Process Manager=8.5.7.0-cf201609
IBM Business Process Manager=8.5.7.0-cf201612
IBM Business Process Manager=8.5.7.0-cf201703
IBM Business Process Manager=8.5.7.0-cf201706
IBM Business Process Manager=8.6.0.0
IBM Business Process Manager=8.6.0.0-cf201712
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.0-cf2
IBM Business Process Manager=8.5.6.1
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.7.0
IBM Business Process Manager=8.5.7.0-cf201606
IBM Business Process Manager=8.5.7.0-cf201609
IBM Business Process Manager=8.5.7.0-cf201612
IBM Business Process Manager=8.5.7.0-cf201703
IBM Business Process Manager=8.5.7.0-cf201706
Remediation
Patch Available
Event History
Mar 30, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2017-1766?
CVE-2017-1766 is a vulnerability in IBM Business Process Manager 8.6 that allows an attacker to claim and work on ad hoc tasks they are not assigned to.
2
How severe is CVE-2017-1766?
CVE-2017-1766 has a severity rating of 4.3 (medium).
3
Which software versions are affected by CVE-2017-1766?
IBM Business Process Manager versions 8.5.5.0 to 8.5.7.0 are affected by CVE-2017-1766.
4
What is the Common Vulnerabilities and Exposures (CVE) ID for this vulnerability?
The Common Vulnerabilities and Exposures (CVE) ID for this vulnerability is CVE-2017-1766.
5
How can I fix the vulnerability CVE-2017-1766?
To fix the vulnerability CVE-2017-1766, update IBM Business Process Manager to a version that is not affected (8.6.0.0 or later).