CVE-2017-1539

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
IBMBusiness Process Manager Advanced7.5; 7.5.0.1; 7.5.1; 7.5.1.1; 7.5.1.2; 8.0; 8.0.1; 8.0.1.1; 8.0.1.2; 8.5; 8.5.0.1; 8.5.5; 8.0.1.3; 8.5.6; 8.5.0.2; 8.5.7; 8.5.7.CF201609; 8.5.6.1; 8.5.6.2; 8.5.7.CF201606

References

Timeline

Published
Sep 26, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-153906.5Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via ICVE-2017-153916.5Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages witCVE-2017-153924.3Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potenCVE-2017-153938.8Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain acceCVE-2017-153946.5Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing inCVE-2017-153956.5A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafCVE-2017-153966.5A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google ChroCVE-2017-153977.4Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network positiCVE-2017-153989.8A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code executionCVE-2017-153998.8A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a craftedCVE-2017-15405.4IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code iCVE-2017-154007.8Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command wit
CVE-2017-1539: High severity, CVSS 8.8 | Vulnix