PT-2017-5594 · Red Hat · Jbpm Kie Workbench

Grégory Draperi · Publicado 2017-12-19 · Atualizado 2018-01-05 · CVE-2013-6465

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: JBPM KIE Workbench versions 6.0.x

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.

Recommendations: For JBPM KIE Workbench versions 6.0.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-6465

Produtos afetados

Jbpm Kie Workbench

Referências · 4

• https://github.com/kiegroup/jbpm-wb/compare/6.0.x · Nota
• https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=1048380 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-6465 · Nota de Segurança