Business Process Manager
Vendor:
First CVE: Jul 6, 2013 · Active for 13 years
89
Total CVEs
More Total CVEs than 99% of tracked products
8.9
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
5.2
Avg CVSS
Higher Avg CVSS than 9% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Business Process Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 6, 2013
13 years ago
Most Recent CVE
Dec 7, 2022
1,327 days ago
CVE Severity & Scoring
Business Process Manager89 CVEs
15%
78%
All CVEs352,719 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local3 (3.4%)
Network57 (64.0%)
Unknown29 (32.6%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low57 (64.0%)
High3 (3.4%)
Unknown29 (32.6%)
User Interaction
None27 (30.3%)
Unknown29 (32.6%)
Required33 (37.1%)
Privileges Required
Low45 (50.6%)
High1 (1.1%)
None14 (15.7%)
Unknown29 (32.6%)
Top CVEs
Signals from CVEs in this product scope (89 CVEs).
89 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-2000HIGH IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions trans | Apr 8, 2019 | 8.8 | 29 | NO | NO |
CVE-2015-1961HIGH The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remo | Jul 13, 2015 | 9.0 | 29 | NO | NO |
CVE-2018-1674HIGH IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which cou | Sep 20, 2018 | 8.8 | 28 | NO | NO |
CVE-2017-1539HIGH IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. | Sep 26, 2017 | 8.8 | 27 | NO | NO |
CVE-2019-4424HIGH IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A rem | Aug 20, 2019 | 8.2 | 26 | NO | NO |
CVE-2017-1769HIGH IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user tha | Jan 24, 2018 | 8.8 | 26 | NO | NO |
CVE-2017-1527HIGH IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerab | Sep 26, 2017 | 8.1 | 26 | NO | NO |
CVE-2021-38900MEDIUM IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to | Dec 21, 2021 | 6.5 | 23 | NO | NO |
CVE-2017-1628MEDIUM IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks. | Nov 27, 2017 | 6.5 | 23 | NO | NO |
CVE-2022-22361MEDIUM IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflo | May 31, 2022 | 6.5 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (89 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (89 CVEs).
Media Mentions
Signals from CVEs in this product scope (89 CVEs).
Top CNAs Publishing CVEs For Business Process Manager
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.6.0.0 | 34 | 5.8 | 1.1% | 0 | 0 |
| 8.6 | 2 | 5.2 | 0.9% | 0 | 0 |
| 8.5.7.0 | 37 | 5.3 | 1.0% | 0 | 0 |
| 8.5.6.2 | 20 | 5.5 | 1.0% | 0 | 0 |
| 8.5.6.1 | 16 | 5.4 | 1.0% | 0 | 0 |
| 8.5.6.0 | 41 | 5.3 | 1.1% | 0 | 0 |
| 8.5.5.0 | 60 | 5.1 | 1.2% | 0 | 0 |
| 8.5.5 | 1 | 6.1 | 0.7% | 0 | 0 |
| 8.5.0.2 | 20 | 5.5 | 0.9% | 0 | 0 |
| 8.5.0.1 | 51 | 4.9 | 1.2% | 0 | 0 |
| 8.5.0.0 | 57 | 5.0 | 1.2% | 0 | 0 |
| 8.5 | 2 | 5.8 | 0.8% | 0 | 0 |
| 8.0.1.3 | 38 | 5.0 | 1.2% | 0 | 0 |
| 8.0.1.2 | 44 | 4.9 | 1.2% | 0 | 0 |
| 8.0.1.1 | 45 | 4.9 | 1.2% | 0 | 0 |
| 8.0.1.0 | 44 | 4.9 | 1.3% | 0 | 0 |
| 8.0.1 | 1 | 6.1 | 0.7% | 0 | 0 |
| 8.0.0.0 | 46 | 4.9 | 1.3% | 0 | 0 |
| 8.0 | 1 | 6.1 | 0.7% | 0 | 0 |
| 7.5.1.2 | 28 | 5.0 | 1.1% | 0 | 0 |