IBM Business Process Manager CVE-2017-1424 HTML Injection Vulnerability
BID:100962
CVE-2017-1424 |Info
IBM Business Process Manager CVE-2017-1424 HTML Injection Vulnerability
| Bugtraq ID: | 100962 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-1424 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 22 2017 12:00AM |
| Updated: | Sep 22 2017 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Business Process Manager Advanced 8.5.7.0 CF 2017.06 IBM Business Process Manager Advanced 8.5.7.0 CF 2016.12 IBM Business Process Manager Advanced 8.5.7.0 |
| Not Vulnerable: | |
Discussion
IBM Business Process Manager CVE-2017-1424 HTML Injection Vulnerability
IBM Business Process Manager is prone to an HTML-injection vulnerability.
Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.
IBM Business Process Manager Advanced 8.5.7.0 8.5.7.0 through 8.5.7.0 Cumulative Fix 2017.06 are vulnerable.
IBM Business Process Manager is prone to an HTML-injection vulnerability.
Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.
IBM Business Process Manager Advanced 8.5.7.0 8.5.7.0 through 8.5.7.0 Cumulative Fix 2017.06 are vulnerable.
References
IBM Business Process Manager CVE-2017-1424 HTML Injection Vulnerability
References:
References: