Unscored severity · published Aug 17, 2014
CVE-2014-3087
callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files…
–
CVSS
1.3%
EPSS
No
On KEV
Description
callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Business Process Manager · Ibm
7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more · source: NVD
WA
Websphere Application Server · Ibm
7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3087
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3087
secunia.com
http://secunia.com/advisories/60752
secunia.com
http://secunia.com/advisories/60755
secunia.com
http://secunia.com/advisories/60757
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21679726
www.securityfocus.com
http://www.securityfocus.com/bid/69264
More from Business Process Manager
8.8
CVE-2018-2000
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
8.8
CVE-2018-1674
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection
8.8
CVE-2017-1769
IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.8
CVE-2017-1539
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships
8.2
CVE-2019-4424
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data