IBM FileNet P8 Content Engine (aka P8CE) 4.0.1 through 5.0.0, as used in FileNet P8 Content Manager (CM) and FileNet P8 Business Process Manager (BPM), does not require the PRIVILEGED_WRITE access role for all intended Object Store modifications, which allows remote attackers to change a privileged property of an object via unspecified vectors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Filenet_p8_content_engine | Ibm | 4.0.1 (including) | 4.0.1 (including) |
| Filenet_p8_content_engine | Ibm | 4.0.1.10 (including) | 4.0.1.10 (including) |
| Filenet_p8_content_engine | Ibm | 4.0.1.11 (including) | 4.0.1.11 (including) |
| Filenet_p8_content_engine | Ibm | 4.0.1.12 (including) | 4.0.1.12 (including) |
| Filenet_p8_content_engine | Ibm | 4.0.1.13 (including) | 4.0.1.13 (including) |
| Filenet_p8_content_engine | Ibm | 4.5.0 (including) | 4.5.0 (including) |
| Filenet_p8_content_engine | Ibm | 4.5.0.2 (including) | 4.5.0.2 (including) |
| Filenet_p8_content_engine | Ibm | 4.5.1.3 (including) | 4.5.1.3 (including) |
| Filenet_p8_content_engine | Ibm | 4.5.1.4 (including) | 4.5.1.4 (including) |
| Filenet_p8_content_engine | Ibm | 4.5.1.5 (including) | 4.5.1.5 (including) |
| Filenet_p8_content_engine | Ibm | 4.5.1.6 (including) | 4.5.1.6 (including) |
| Filenet_p8_content_engine | Ibm | 5.0.0 (including) | 5.0.0 (including) |
References
- http://secunia.com/advisories/43347
- http://www-01.ibm.com/support/docview.wss?uid=swg21462438
- http://www.securityfocus.com/bid/46432
- http://www.vupen.com/english/advisories/2011/0423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65448
- http://secunia.com/advisories/43347
- http://www-01.ibm.com/support/docview.wss?uid=swg21462438
- http://www.securityfocus.com/bid/46432
- http://www.vupen.com/english/advisories/2011/0423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65448