Unscored severity · published Dec 16, 2014
CVE-2014-6176
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5…
–
CVSS
1.8%
EPSS
No
On KEV
Description
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Business Process Manager · Ibm
7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 8.0.0.0; 8.0.1.0; +6 more · source: NVD
WE
Websphere Enterprise Service Bus · Ibm
7.0 · source: NVD
WP
Websphere Process Server · Ibm
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6176
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1JR51593
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21690780
www.securitytracker.com
http://www.securitytracker.com/id/1031382
www.securitytracker.com
http://www.securitytracker.com/id/1031383
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/98488
More from Business Process Manager
8.8
CVE-2018-2000
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
8.8
CVE-2018-1674
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection
8.8
CVE-2017-1769
IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.8
CVE-2017-1539
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships
8.2
CVE-2019-4424
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data