IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities
BID:56583
Info
IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 56583 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 16 2012 12:00AM |
| Updated: | Nov 19 2012 01:20PM |
| Credit: | IBM |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities
IBM Business Process Manager is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of the victim in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
IBM Business Process Manager 8.0 and 8.0.1 are vulnerable; other versions may also be affected.
IBM Business Process Manager is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of the victim in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
IBM Business Process Manager 8.0 and 8.0.1 are vulnerable; other versions may also be affected.
Exploit / POC
IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities
References:
References:
- IBM Homepage (IBM)