Cross-Site Scripting Threat in IBM Business Process Manager
CVE-2017-1494

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Business Process Manager Advanced
Vendor
CVE Published:
20 December 2017

Summary

IBM Business Process Manager 8.5 is susceptible to a cross-site scripting flaw that permits unauthorized users to inject arbitrary JavaScript code into the application's Web UI. This manipulation can change the expected behavior of the application, posing a risk of exposing sensitive user credentials during active sessions. The presence of this vulnerability underlines the importance of validating user input in web applications to prevent unauthorized script execution.

Affected Version(s)

Business Process Manager Advanced 8.5.5

Business Process Manager Advanced 8.5.6

Business Process Manager Advanced 8.5.7

References

http://www.securityfocus.com/bid/102218
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1040355
vdb-entryx_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/128692
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.