CVE-2014-4802

no score yetEPSS 1.1%

The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by executing a saved search.

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2014-10-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ibm:business_process_manager

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984
http://www-01.ibm.com/support/docview.wss?uid=swg21684771
https://exchange.xforce.ibmcloud.com/vulnerabilities/95304
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984
http://www-01.ibm.com/support/docview.wss?uid=swg21684771

Check your stack JSON