IBM Business Process Manager Enterprise Service Bus vulnerabilities

4 CVEs affecting IBM Business Process Manager Enterprise Service Bus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1885, published 2019-04-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1885, published 2019-04-08. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020.
CVE-2017-1765, published 2018-03-30. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150.
CVE-2018-1384, published 2018-03-30. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2017-1756, published 2018-03-30. Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856.