IBM Process Mining File Upload Vulnerability

Executive Summary

IBM Process Mining 2.0.0 through 2.2.1 allows an authenticated user to upload files with dangerous types. If another user opens these files, the uploaded content could be executed, potentially leading to unauthorized actions or data compromise.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access could upload malicious files that execute when opened by another user. This may result in data theft, system compromise, or unauthorized operations within the IBM Process Mining environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade IBM Process Mining to version 2.2.1 IF001 or later to address the vulnerability. Ensure all dependencies like MongoDB Python Driver, urllib3, and others are updated to their latest secure versions as recommended by IBM.

Useful 0 Not Useful 0