PT-2018-7174 · Red Hat · Bpm Suite 6+2

Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-2674

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3

Description: The issue is related to a stored XSS flaw in Business Central, specifically due to the lack of sanitation of user input when creating new lists. This allows remote, authenticated attackers with list creation privileges to store scripts in lists, which are then displayed to other users, including administrators, without proper sanitization.

Recommendations: For JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue.

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2017-2674

Affected Products

Bpm Suite 6

Business Central

Jboss Brms 6

References · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2674 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1218 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1217 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2674 · Vendor Advisory
• http://securityfocus.com/bid/98390 · Note