CVE-2014-6139

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-02-13 · updated 2026-06-17
Weakness: CWE-264

Description

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter.

Affected products

IBM Business Process Manager: 8.0.1.3, 8.5.0.1, 8.5.5.0

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391
http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391

Get alerted when CVE-2014-6139 or the next vulnerability affects your stack