CVE-2017-1346: ibm business_process_manager

Vulnerability summary

CVE-2017-1346 is a low (CVSS 2.5) vulnerability in ibm business_process_manager. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities.

Timeline

1. 25-09-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.