CVE-2015-0101

MEDIUM

IBM Business Process Manager 7.5.x-8.5.x - Cross-Site Scripting

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; and IBM Business Process Manager Advanced 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/72920
Mitigation, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21693134

Scores

CVSS v3 6.1
EPSS 0.0071
EPSS Percentile 49.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (13)
ibm/business_process_manager 7.5 (3 CPE variants)
ibm/business_process_manager 7.5.0.1 (3 CPE variants)
ibm/business_process_manager 7.5.1 (3 CPE variants)
ibm/business_process_manager 7.5.1.1 (3 CPE variants)
ibm/business_process_manager 7.5.1.2 (3 CPE variants)
ibm/business_process_manager 8.0 (3 CPE variants)
ibm/business_process_manager 8.0.1 (3 CPE variants)
ibm/business_process_manager 8.0.1.1 (3 CPE variants)
ibm/business_process_manager 8.0.1.2 (3 CPE variants)
ibm/business_process_manager 8.0.1.3 (3 CPE variants)
... and 3 more
Published Aug 28, 2017
Tracked Since Feb 18, 2026