CVE-2014-4759: IBM Business Process Manager

Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days.

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results.

Affected products

• IBM Business Process Manager: version 8.5.0.0 only; version 8.5.0.1 only; version 8.5.5.0 only

Published 2014-09-04. Last modified 2026-06-17.