IBMF362F630FE5AEF83B5FDA4F597AEB3FB8C46F82DDB545052FD29729AB3EBA9ADSecurity Bulletin: Cross Site Scripting vulnerability in IBM Business Process Manager (BPM) (CVE-2016-6109)
Summary
IBM BPM is vulnerable to cross-site scripting, caused by improper neutralization of user-supplied input in some error situations.
Vulnerability Details
CVEID: CVE-2016-6109**
DESCRIPTION:** IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118266 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
- IBM BPM V7.5.0.0 through V7.5.1.2
- IBM BPM V8.0.0.0 through V8.0.1.3
- IBM BPM V8.5.0.0 through V8.5.0.2
- IBM BPM V8.5.5.0
- IBM BPM V8.5.6.0 through V8.5.6.0 Cumulative Fix (CF) 2
- IBM BPM V8.5.7.0 through V8.5.7.0 CF 2016.12
Remediation/Fixes
The recommended solution is to apply the Interim Fix (iFix) or CF containing APAR JR56800 as soon as practical:
- IBM Business Process Manager Advanced
- IBM Business Process Manager Standard
- IBM Business Process Manager Express
As IBM Business Process Manager V7.5 is out of general support, customers with a support extension contract can contact IBM support to request the fix.
For IBM BPM V7.5.0.0 through V7.5.1.2:
- Upgrade to minimal Refresh Pack 1, install Fix Pack 2 as required by iFix and then apply iFix JR56800
For IBM BPM V8.0.0.0 through V8.0.1.3
- Upgrade to minimal Refresh Pack 1, install Fix Pack 3 as required by iFix and then apply iFix JR56800
For IBM BPM V8.5.0.0 through V8.5.0.2
- Install Fix Pack 2 as required by iFix and then apply iFix JR56800
For IBM BPM V8.5.5.0
- Apply iFix JR56800
For IBM BPM V8.5.6.0 through V8.5.6.0 CF2
For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2016.12
- Install CF 2017.03
Workarounds and Mitigations
None
