CVE-2015-1904

IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management (ECM) integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypass intended document-access restrictions via a (1) upload or (2) download action.

• CWE-264

• http://www-01.ibm.com/support/docview.wss?uid=swg1JR53209Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21960293Patch, Vendor Advisory
• http://www.securitytracker.com/id/1033159
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR53209Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21960293Patch, Vendor Advisory
• http://www.securitytracker.com/id/1033159

Published

Aug 1, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1898Stack-based buffer overflow in the FastBackMount process in …
• CVE-2015-1899IBM WebSphere Portal 8.5 through CF05 allows remote attacker…
• CVE-2015-1900IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 throug…
• CVE-2015-1901The installer in IBM InfoSphere Information Server 8.5 throu…
• CVE-2015-1902Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 F…
• CVE-2015-1903Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 F…
• CVE-2015-1905The REST API in IBM Business Process Manager (BPM) 7.5.x thr…
• CVE-2015-1906Cross-site scripting (XSS) vulnerability in the REST API in …
• CVE-2015-1907The Administration and Reporting Tool in IBM Rational Licens…
• CVE-2015-1908Cross-site scripting (XSS) vulnerability in IBM WebSphere Po…
• CVE-2015-1909The XML parser in the Reference Data Management component in…
• CVE-2015-1910Cross-site scripting (XSS) vulnerability in the Reference Da…