CVE-2017-2674

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins.
References
Link Resource
http://www.securityfocus.com/bid/98390 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1217 Broken Link Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1218 Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_bpm_suite:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-07-27 18:29

Updated : 2024-02-28 16:48


NVD link : CVE-2017-2674

Mitre link : CVE-2017-2674

CVE.ORG link : CVE-2017-2674


JSON object : View

Products Affected

redhat

  • jboss_bpm_suite
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-20

Improper Input Validation