CVE-2017-2674

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins.
References
Link Resource
http://www.securityfocus.com/bid/98390 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1217 Broken Link Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1218 Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 Issue Tracking Vendor Advisory
http://www.securityfocus.com/bid/98390 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1217 Broken Link Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1218 Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_bpm_suite:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:23

Type Values Removed Values Added
CVSS v2 : 3.5
v3 : 5.4
v2 : 3.5
v3 : 6.1
References () http://www.securityfocus.com/bid/98390 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/98390 - Third Party Advisory, VDB Entry
References () https://access.redhat.com/errata/RHSA-2017:1217 - Broken Link, Vendor Advisory () https://access.redhat.com/errata/RHSA-2017:1217 - Broken Link, Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2017:1218 - Broken Link, Vendor Advisory () https://access.redhat.com/errata/RHSA-2017:1218 - Broken Link, Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 - Issue Tracking, Vendor Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 - Issue Tracking, Vendor Advisory

Information

Published : 2018-07-27 18:29

Updated : 2024-11-21 03:23


NVD link : CVE-2017-2674

Mitre link : CVE-2017-2674

CVE.ORG link : CVE-2017-2674


JSON object : View

Products Affected

redhat

  • jboss_bpm_suite
CWE
CWE-20

Improper Input Validation

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')