PT-2018-8383 · Red Hat · Bpm Suite 6+1

Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-7463

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3

Description The issue allows for a reflected XSS attack via artifact upload. If a malformed XML file is uploaded, it causes an error message to appear that includes part of the bad XML code without filtering out scripts. This could allow execution of script code within the context of the affected user.

Recommendations For JBoss BRMS 6 and BPM Suite 6 versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the upload of XML files or validating and sanitizing all uploaded files to prevent malicious code execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-7463

Affected Products

Bpm Suite 6

Jboss Brms 6

References · 6

• https://osv.dev/vulnerability/CVE-2017-7463 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1218 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7463 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7463 · Security Note
• http://securityfocus.com/bid/98385 · Note