IBM Support

Security Bulletin: Security vulnerability in Node.js module affects IBM Business Process Manager (BPM) Configuration Editor (CVE-2015-1164)

Created by Jens Engelke on
Published URL:
https://www.ibm.com/support/pages/node/524511
524511

Security Bulletin


Summary

A security vulnerability has been reported for a dependent Node.js module "express". CVE-2015-1164 affects IBM Business Process Manager (BPM) because IBM BPM includes a stand-alone tool for editing configuration properties files that is based on open source Node.js technology.

Vulnerability Details

CVE-ID: CVE-2015-1164
Description: serve-static module for Node.js could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. A remote attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites.
CVSS Base Score: 4.3
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/99936 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

    • IBM Business Process Manager Express V8.5.5
    • IBM Business Process Manager Standard V8.5.5
    • IBM Business Process Manager Advanced V8.5.5

Remediation/Fixes

Install IBM Business Process Manager interim fix JR52288 as appropriate for your current IBM Business Process Manager.

Workarounds and Mitigations

IBM BPM Configuration Editor is a stand-alone tool that is shipped as a zip archive. Vulnerabilities can only be exploited after unzipping and starting the server part of the tool. As a work around, you can use any usual text editor to work with IBM BPM configuration properties files.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Node.js security advisory

Change History

2015-02-13 initial version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSFTN5","label":"IBM Business Process Manager Advanced"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Security","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"8.5.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSFTBX","label":"IBM Business Process Manager Express"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Security","Platform":[{"code":"PF016","label":"Linux"},{"code":"","label":"Linux zSeries"},{"code":"PF033","label":"Windows"}],"Version":"8.5.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSFTDH","label":"IBM Business Process Manager Standard"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Security","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"","label":"Linux zSeries"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.5.5","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
15 June 2018

UID

swg21694924

Page Feedback