CVE-2015-0103

IBM Business Process Manager 8.0-8.0.1.3, 8.5.0-8.5.0.1, 8.5.5-8.5.5.0 - Authenticated Cross-Site Scripting

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50457
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21693270

Scores

EPSS 0.0100
EPSS Percentile 59.1%

Details

CWE
CWE-79
Status published
Products (8)
ibm/business_process_manager 8.0.0.0 (3 CPE variants)
ibm/business_process_manager 8.0.1.0 (3 CPE variants)
ibm/business_process_manager 8.0.1.1 (3 CPE variants)
ibm/business_process_manager 8.0.1.2 (3 CPE variants)
ibm/business_process_manager 8.0.1.3 (3 CPE variants)
ibm/business_process_manager 8.5.0.0 (3 CPE variants)
ibm/business_process_manager 8.5.0.1 (3 CPE variants)
ibm/business_process_manager 8.5.5.0 (3 CPE variants)
Published Mar 24, 2015
Tracked Since Feb 18, 2026