PT-2018-5029 · Red Hat · Bpm Suite 6+1

Pavel Polischouk · Published 2018-08-01 · Updated 2023-02-12 · CVE-2016-8608

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JBoss BRMS 6 and BPM Suite 6

Description The issue is related to a stored XSS flaw in the business process editor, caused by an incomplete fix. Remote, authenticated attackers with privileges to create business processes can store scripts that are not properly sanitized, allowing them to be executed when shown to other users, including administrators.

Recommendations For JBoss BRMS 6 and BPM Suite 6, consider restricting access to the business process editor to minimize the risk of exploitation until a proper fix is applied. As a temporary workaround, ensure that all scripts created within business processes are manually sanitized before being displayed to other users.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-8608

Affected Products

Bpm Suite 6

Jboss Brms 6

References · 6

• https://osv.dev/vulnerability/CVE-2016-8608 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2822.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8608 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-2823.html · Vendor Advisory
• http://securityfocus.com/bid/94568 · Note