Cross-Site Scripting Threat in IBM Business Process Manager
CVE-2017-1494
5.4MEDIUM
Key Information:
- Vendor
- IBM
- Vendor
- CVE Published:
- 20 December 2017
Summary
IBM Business Process Manager 8.5 is susceptible to a cross-site scripting flaw that permits unauthorized users to inject arbitrary JavaScript code into the application's Web UI. This manipulation can change the expected behavior of the application, posing a risk of exposing sensitive user credentials during active sessions. The presence of this vulnerability underlines the importance of validating user input in web applications to prevent unauthorized script execution.
Affected Version(s)
Business Process Manager Advanced 8.5.5
Business Process Manager Advanced 8.5.6
Business Process Manager Advanced 8.5.7
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved