CVE-2016-8608
MEDIUMJBoss BRMS 6 and BPM Suite 6 - Authenticated Stored Cross-Site Scripting via Business Process Editor
Title source: llmDescription
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94568
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608
Broken Link vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2823.html
Broken Link vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2822.html
Scores
CVSS v3
5.4
EPSS
0.0126
EPSS Percentile
66.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
redhat/jboss_bpm_suite
6.0.0
redhat/jboss_business_rules_management_system
6.0.0
Published
Aug 01, 2018
Tracked Since
Feb 18, 2026