PT-2018-8383 · Red Hat · Bpm Suite 6+1

Publicado 2018-07-27 · Atualizado 2019-10-09 · CVE-2017-7463

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3

Description The issue allows for a reflected XSS attack via artifact upload. If a malformed XML file is uploaded, it causes an error message to appear that includes part of the bad XML code without filtering out scripts. This could allow execution of script code within the context of the affected user.

Recommendations For JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the upload of XML files or validating and sanitizing all uploaded files to prevent malicious code execution.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-7463

Produtos afetados

Bpm Suite 6

Jboss Brms 6

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-7463 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1218 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7463 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1217 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7463 · Nota de Segurança
• http://securityfocus.com/bid/98385 · Nota