IBM Business Process Manager CVE-2015-0156 Unspecified HTML Injection Vulnerability
BID:74658
Info
IBM Business Process Manager CVE-2015-0156 Unspecified HTML Injection Vulnerability
| Bugtraq ID: | 74658 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-0156 |
| Remote: | Yes |
| Local: | No |
| Published: | May 13 2015 12:00AM |
| Updated: | May 13 2015 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM WebSphere Lombardi 7.2 IBM Business Process Manager Standard 8.5.6 IBM Business Process Manager Standard 8.5.5 IBM Business Process Manager Standard 8.0.1 IBM Business Process Manager Standard 7.5.1 IBM Business Process Manager Standard 8.5.0.1 IBM Business Process Manager Standard 8.5.0 IBM Business Process Manager Standard 8.5 IBM Business Process Manager Standard 8.0.1.3 IBM Business Process Manager Standard 8.0.1.2 IBM Business Process Manager Standard 8.0.1.1 IBM Business Process Manager Standard 8.0 IBM Business Process Manager Standard 7.5.1.2 IBM Business Process Manager Standard 7.5.1.1 IBM Business Process Manager Standard 7.5.0.1 IBM Business Process Manager Standard 7.5.0 IBM Business Process Manager Standard 7.5 IBM Business Process Manager Express 8.5.6 IBM Business Process Manager Express 8.5.5 IBM Business Process Manager Express 8.0.1 IBM Business Process Manager Express 7.5.1 IBM Business Process Manager Express 8.5.0.1 IBM Business Process Manager Express 8.5 IBM Business Process Manager Express 8.0.1.3 IBM Business Process Manager Express 8.0.1.2 IBM Business Process Manager Express 8.0.1.1 IBM Business Process Manager Express 8.0 IBM Business Process Manager Express 7.5.1.2 IBM Business Process Manager Express 7.5.1.1 IBM Business Process Manager Express 7.5.0.1 IBM Business Process Manager Express 7.5 IBM Business Process Manager Advanced 8.5.6 IBM Business Process Manager Advanced 8.5.5 IBM Business Process Manager Advanced 8.5 IBM Business Process Manager Advanced 8.0.1 IBM Business Process Manager Advanced 7.5.1 IBM Business Process Manager Advanced 8.5.0.1 IBM Business Process Manager Advanced 8.5 IBM Business Process Manager Advanced 8.0.1.3 IBM Business Process Manager Advanced 8.0.1.2 IBM Business Process Manager Advanced 8.0.1.1 IBM Business Process Manager Advanced 8.0.0 IBM Business Process Manager Advanced 8.0 IBM Business Process Manager Advanced 7.5.1.2 IBM Business Process Manager Advanced 7.5.1.1 IBM Business Process Manager Advanced 7.5.0.1 IBM Business Process Manager Advanced 7.5.0 IBM Business Process Manager Advanced 7.5 |
| Not Vulnerable: | |
Discussion
IBM Business Process Manager CVE-2015-0156 Unspecified HTML Injection Vulnerability
IBM Business Process Manager is prone to an unspecified HTML-injection vulnerability.
Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.
IBM Business Process Manager is prone to an unspecified HTML-injection vulnerability.
Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.
Solution / Fix
IBM Business Process Manager CVE-2015-0156 Unspecified HTML Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.