CVE-2017-7463

Medium

Description

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes an error message to appear that includes part of the bad XML code verbatim without filtering out scripts. Successful exploitation would allow execution of script code within the context of the affected user.

SeverityMedium

CVSS6.1

Exploit probability—

Product

Redhat Jboss Bpm Suite

PublishedJul 27, 2018

First seenJul 27, 2018

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

redhat jboss_bpm_suite6.4.3 or later

Vendor advisories

access.redhat.com/errata/RHSA-2017:1217
access.redhat.com/errata/RHSA-2017:1218

Affected products

Product	Affected versions	Fixed in
redhat jboss_bpm_suite	6.0.0 ≤ v < 6.4.3	6.4.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.