PT-2017-5594 · Red Hat · Jbpm Kie Workbench

Grégory Draperi · Published 2017-12-19 · Updated 2018-01-05 · CVE-2013-6465

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: JBPM KIE Workbench versions 6.0.x

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.

Recommendations: For JBPM KIE Workbench versions 6.0.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-6465

Affected Products

Jbpm Kie Workbench

References · 4

• https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1048380 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-6465 · Security Note
• https://github.com/kiegroup/jbpm-wb/compare/6.0.x · Note