PT-2018-7174 · Red Hat · Bpm Suite 6+2

Publicado 2018-07-27 · Atualizado 2019-10-09 · CVE-2017-2674

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3

Description: The issue is related to a stored XSS flaw in Business Central, specifically due to the lack of sanitation of user input when creating new lists. This allows remote, authenticated attackers with list creation privileges to store scripts in lists, which are then displayed to other users, including administrators, without proper sanitization.

Recommendations: For JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue.

Correção

RCE

XSS

Enumeração de Fraquezas

CWE-20

CWE-79

Identificadores relacionados

CVE-2017-2674

Produtos afetados

Bpm Suite 6

Business Central

Jboss Brms 6

Referências · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2674 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:1218 · Aviso do Fabricante
• http://securityfocus.com/bid/98390 · Nota
• https://access.redhat.com/errata/RHSA-2017:1217 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2674 · Aviso do Fabricante