Lucene search

K
ibmIBM397D68D3C3291AA21D6140ED933A491F8DAB226A2DE11E7BED998396E0A8B533
HistoryJun 15, 2018 - 7:05 a.m.

Security Bulletin: Cross-Site scripting vulnerability in IBM Business Process Manager document list control (CVE-2016-0227)

2018-06-1507:05:10
www.ibm.com
4

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

35.0%

Summary

Due to insufficient user input escaping IBM Business Process Manager document list control is vulnerable to Cross-Site scripting.

Vulnerability Details

CVEID: CVE-2016-0227**
DESCRIPTION:** IBM Business Process Manager is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110088 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

  • IBM Business Process Manager V8.0 through V8.0.1.3
  • IBM Business Process Manager V8.5.0 through V8.5.0.2
  • IBM Business Process Manager V8.5.5
  • IBM Business Process Manager V8.5.6 through V8.5.6.0 cumulative fix 2

Remediation/Fixes

Install the interim fixes for APAR JR55152 as appropriate for your current IBM Business Process Manager version.

Workarounds and Mitigations

None

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

35.0%

Related for 397D68D3C3291AA21D6140ED933A491F8DAB226A2DE11E7BED998396E0A8B533