{"api_version":"1","generated_at":"2026-07-23T13:12:11+00:00","cve":"CVE-2014-0908","urls":{"html":"https://cve.report/CVE-2014-0908","api":"https://cve.report/api/cve/CVE-2014-0908.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-0908","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0908"},"summary":{"title":"CVE-2014-0908","description":"The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.","state":"PUBLISHED","assigner":"ibm","published_at":"2014-04-10 23:55:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6","severity":"","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21669330","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21669330","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM Security Bulletin: Missing authorization concept for IBM Business Process Manager (BPM) User Attributes CVE-2014-0908 - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91870","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91870","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"JR49505: SECURITY APAR CVE-2014-0908 - MISSING AUTHORIZATION CONCEPT FOR USER ATTRIBUTES","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0908","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0908","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:27:20.162Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21669330"},{"name":"JR49505","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505"},{"name":"ibm-bpm-cve20140908-priv-escalation(91870)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91870"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-04-04T00:00:00.000Z","descriptions":[{"lang":"en","value":"The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21669330"},{"name":"JR49505","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505"},{"name":"ibm-bpm-cve20140908-priv-escalation(91870)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91870"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2014-0908","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21669330","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21669330"},{"name":"JR49505","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505"},{"name":"ibm-bpm-cve20140908-priv-escalation(91870)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91870"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2014-0908","datePublished":"2014-04-10T23:00:00.000Z","dateReserved":"2014-01-06T00:00:00.000Z","dateUpdated":"2024-08-06T09:27:20.162Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-04-10 23:55:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"42264DE4-CEED-4FA5-8C77-82BF9A55F3F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A5E78ECD-6FFA-4AA0-B8B4-F9C002D6F8EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*","matchCriteriaId":"DAC02B89-813E-4B3D-B518-6565BE06C575"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*","matchCriteriaId":"06DFA125-9D52-4C16-9946-DB8D43700415"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*","matchCriteriaId":"613CC0CD-083E-439A-9A53-777E69CDE2DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*","matchCriteriaId":"161542A0-E919-4105-AD4F-C881ACF8D26B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*","matchCriteriaId":"AF8D1DC9-CB5E-4627-8689-B5FA7C5DE1C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*","matchCriteriaId":"32504DEB-7391-4452-BA2E-409959B24222"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*","matchCriteriaId":"D8F74820-DF10-499E-AF7A-93AC285843D1"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"989C89DF-C6CB-45C9-9592-30A83896BD71"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"783C2592-9669-4C75-9E63-C834482F6F8A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"908","Ordinal":"1","Title":"CVE-2014-0908","CVE":"CVE-2014-0908","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"908","Ordinal":"1","NoteData":"The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.","Type":"Description","Title":"CVE-2014-0908"},{"CveYear":"2014","CveId":"908","Ordinal":"2","NoteData":"2014-04-10","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"908","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}