IBM Business Process Manager and WebSphere Lombardi Edition Directory Traversal Vulnerability

Bugtraq ID:	75360
Class:	Input Validation Error
CVE:	CVE-2015-1884
Remote:	Yes
Local:	No
Published:	Jun 22 2015 12:00AM
Updated:	Jun 22 2015 12:00AM
Credit:	IBM
Vulnerable:	IBM WebSphere Lombardi Edition 7.2 IBM Marketing Operations 9.1.1 IBM Marketing Operations 9.1 IBM Marketing Operations 9.0 IBM Marketing Operations 8.6 IBM Marketing Operations 8.5 IBM Marketing Operations 8.2 IBM Marketing Operations 8.1 IBM Marketing Operations 8.0 IBM Marketing Operations 7.6 IBM Marketing Operations 7.5 IBM Marketing Operations 7.4 IBM Marketing Operations 7.3 IBM Marketing Operations 7.2 IBM Marketing Operations 7.1 IBM Marketing Operations 7.0 IBM Business Process Manager Standard 8.5.5 IBM Business Process Manager Standard 8.0.1 IBM Business Process Manager Standard 7.5.1 IBM Business Process Manager Standard 8.5.0.1 IBM Business Process Manager Standard 8.5.0 IBM Business Process Manager Standard 8.0.1.3 IBM Business Process Manager Standard 8.0.1.2 IBM Business Process Manager Standard 8.0.1.1 IBM Business Process Manager Standard 8.0 IBM Business Process Manager Standard 7.5.1.2 IBM Business Process Manager Standard 7.5.1.1 IBM Business Process Manager Standard 7.5.0.1 IBM Business Process Manager Standard 7.5.0 IBM Business Process Manager Express 8.5.5 IBM Business Process Manager Express 8.0.1 IBM Business Process Manager Express 7.5.1 IBM Business Process Manager Express 8.5.0.1 IBM Business Process Manager Express 8.5.0 IBM Business Process Manager Express 8.0.1.3 IBM Business Process Manager Express 8.0.1.2 IBM Business Process Manager Express 8.0.1.1 IBM Business Process Manager Express 8.0.0 IBM Business Process Manager Express 7.5.1.2 IBM Business Process Manager Express 7.5.1.1 IBM Business Process Manager Express 7.5.0.1 IBM Business Process Manager Express 7.5.0 IBM Business Process Manager Advanced 8.5.5 IBM Business Process Manager Advanced 8.5 IBM Business Process Manager Advanced 8.0.1 IBM Business Process Manager Advanced 7.5.1 IBM Business Process Manager Advanced 8.5.0.1 IBM Business Process Manager Advanced 8.0.1.3 IBM Business Process Manager Advanced 8.0.1.2 IBM Business Process Manager Advanced 8.0.1.1 IBM Business Process Manager Advanced 8.0.0 IBM Business Process Manager Advanced 7.5.1.2 IBM Business Process Manager Advanced 7.5.1.1 IBM Business Process Manager Advanced 7.5.0.1 IBM Business Process Manager Advanced 7.5.0
Not Vulnerable:

IBM Business Process Manager and WebSphere Lombardi Edition Directory Traversal Vulnerability

IBM Business Process Manager and WebSphere Lombardi Edition are prone to an unspecified directory-traversal vulnerability.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to download arbitrary files in the context of the application. This may aid in further attacks.

IBM Business Process Manager and WebSphere Lombardi Edition Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.