CVE-2016-8608
5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | BRMS | 6 | affected |
Weaknesses
- CWE-79: CWE-79
ADP Enrichment
CVE Program Container
Additional References
- http://rhn.redhat.com/errata/RHSA-2016-2822.html
- http://www.securityfocus.com/bid/94568
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608
- http://rhn.redhat.com/errata/RHSA-2016-2823.html
References
- http://rhn.redhat.com/errata/RHSA-2016-2822.html
- http://www.securityfocus.com/bid/94568
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608
- http://rhn.redhat.com/errata/RHSA-2016-2823.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.