1. CVE-Search
  2. CVE-2017-1159
ID CVE-2017-1159
Summary IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 122891.
References
Vulnerable Configurations
  • cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.12:*:*:*:*:*:*
    cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2016.12:*:*:*:*:*:*
CVSS
Base: 4.9 (as of 02-06-2017 - 12:47)
Impact:
Exploitability:
CWE CWE-601
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:S/C:P/I:P/A:N
refmap via4
bid 98561
confirm http://www.ibm.com/support/docview.wss?uid=swg22000253
Last major update 02-06-2017 - 12:47
Published 22-05-2017 - 20:29
Last modified 02-06-2017 - 12:47
Back to Top