Description
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
CVSS breakdown
CVSS 3.0
Availability
Low
Attack Complexity
Low
Attack Vector
Network
Confidentiality
Low
Integrity
Low
Privileges Required
Low
Scope
Unchanged
User Interaction
None
E
Unchanged
RC
Changed
RL
O
Affected products
- ibm / Business Process Manager8.5 – 8.5
- ibm / Business Process Manager8.5.0.1 – 8.5.0.1
- ibm / Business Process Manager8.5.5 – 8.5.5
- ibm / Business Process Manager8.5.6 – 8.5.6
- ibm / Business Process Manager8.5.7 – 8.5.7
- ibm / Business Process Manager8.6 – 8.6
- ibm / Business Process Manager8.6.0.CF201712 – 8.6.0.CF201712
- ibm / Business Process Manager8.5.0.2 – 8.5.0.2
- ibm / Business Process Manager8.5.6.1 – 8.5.6.1
- ibm / Business Process Manager8.5.6.2 – 8.5.6.2
- ibm / Business Process Manager8.5.7.CF201606 – 8.5.7.CF201606
- ibm / Business Process Manager8.5.7.CF201609 – 8.5.7.CF201609
- ibm / Business Process Manager8.5.7.CF201612 – 8.5.7.CF201612
- ibm / Business Process Manager8.5.7.CF201703 – 8.5.7.CF201703
- ibm / Business Process Manager8.5.7.CF201706 – 8.5.7.CF201706
- ibm / Business Process Manager8.6.0.CF201803 – 8.6.0.CF201803
- ibm / Business Process Manager18.0.0.0 – 18.0.0.0
- ibm / Business Process Manager18.0.0.1 – 18.0.0.1