CVE-2016-3056

MEDIUM

IBM Business Process Manager 7.5-7.5.1.2, 8.0-8.0.1.3, 8.5 < 8.5.7.0 CF2016.09 - Authenticated XSS in Business Space

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93405

Patch, Vendor Advisory vendor-advisory x_refsource_aixapar

http://www-01.ibm.com/support/docview.wss?uid=swg1JR56300

Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21990850

Scores

CVSS v3 5.4

EPSS 0.0098

EPSS Percentile 58.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (13)

ibm/business_process_manager 7.5.0.0 (4 CPE variants)

ibm/business_process_manager 7.5.0.1 (4 CPE variants)

ibm/business_process_manager 7.5.1.0 (4 CPE variants)

ibm/business_process_manager 7.5.1.1 (4 CPE variants)

ibm/business_process_manager 7.5.1.2 (4 CPE variants)

ibm/business_process_manager 8.0.0.0 (4 CPE variants)

ibm/business_process_manager 8.0.1.0 (4 CPE variants)

ibm/business_process_manager 8.0.1.1 (4 CPE variants)

ibm/business_process_manager 8.0.1.2 (4 CPE variants)

ibm/business_process_manager 8.0.1.3 (4 CPE variants)

... and 3 more

Published Oct 14, 2016

Tracked Since Feb 18, 2026