CVEvulnerability
CVE-2016-5398
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-10-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes.
Affected configurations
• redhat jboss bpm suite (<= 6.3.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://rhn.redhat.com/errata/RHSA-2016-1968.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1969.html Vendor Advisory
- http://www.securityfocus.com/bid/93219 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1358523 Issue Tracking, VDB Entry, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1968.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1969.html Vendor Advisory
- http://www.securityfocus.com/bid/93219 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1358523 Issue Tracking, VDB Entry, Vendor Advisory