description: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807.
problem types: Gain Privileges
affected:
{
product: Business Process Manager Advanced
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 7.5.0.1
status: affected, version: 7.5.1
status: affected, version: 7.5.1.1
status: affected, version: 7.5.1.2
status: affected, version: 8.0
status: affected, version: 8.0.1
status: affected, version: 8.0.1.1
status: affected, version: 8.0.1.2
status: affected, version: 8.5
status: affected, version: 8.5.0.1
status: affected, version: 8.5.5
status: affected, version: 8.0.1.3
status: affected, version: 8.5.6
status: affected, version: 8.5.0.2
status: affected, version: 8.5.7
status: affected, version: 8.5.7.CF201609
status: affected, version: 8.5.6.1
status: affected, version: 8.5.6.2
status: affected, version: 8.5.7.CF201606
status: affected, version: 8.5.7.CF201612
status: affected, version: 8.5.7.CF201703
status: affected, version: 8.5.7.CF201706
}