Improper access control in IBM Business Process Manager - CVE-2017-1628
Published: November 15, 2017
Vulnerability identifier: #VU9339
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-1628
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The weakness exists due to an access control flaw in a REST API. A remote attacker can can cause the Event Manager to start or stop.
Successful exploitation of the vulnerability results in denial of service.
Affected software
IBM Business Process Manager
How to mitigate CVE-2017-1628
Install update from vendor's website (APAR JR58466).