IBM Security Bulletin: Incorrect authorization for update of process instance variables in IBM Business Process Manager (CVE-2016-0349)
Due to incorrect authorization for update of process instance variables, users without required permission can update process instance variables in IBM Business Process Manager.
CVE(s): CVE-2016-0349
Affected product(s) and affected version(s):
- IBM Business Process Manager V8.5.7
- IBM Business Process Manager V8.5.6 through V8.5.6.0 cumulative fix 2
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/28RLo30
X-Force Database: http://ift.tt/28SnQaH
from IBM Product Security Incident Response Team http://ift.tt/28RLurl