description: IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.
problem types: Cross-Site Scripting
affected:
{
product: Business Automation Workflow
vendor: IBM
versions:
status: affected, version: 18.0.0.0
status: affected, version: 18.0.0.2
}
{
product: Business Process Manager
vendor: IBM
versions:
status: affected, version: 8.6.0.0
status: affected, version: 8.5.6.0
status: affected, version: 8.5.6.0CF2
status: affected, version: 8.5.7.0
status: affected, version: 8.5.7.0CF2017.06
status: affected, version: 8.6.0.0CF2018.03
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: HIGH
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 5.2
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.0/AC:L/UI:R/AV:N/I:L/PR:L/A:N/S:C/C:L/RL:O/E:H/RC:C
version: 3.0
]