CVE-2014-6173

Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Published: Dec 19, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-6173
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
ibm / business_process_manager	8.5.0.0	8.5.0.0.x
ibm / business_process_manager	8.0.1.0	8.0.1.0.x
ibm / business_process_manager	8.0.1.1	8.0.1.1.x
ibm / business_process_manager	8.5.5.0	8.5.5.0.x
ibm / business_process_manager	8.0.1.3	8.0.1.3.x
ibm / business_process_manager	8.5.0.1	8.5.0.1.x
ibm / business_process_manager	8.0.0.0	8.0.0.0.x
ibm / business_process_manager	8.0.1.2	8.0.1.2.x

http://www-01.ibm.com/support/docview.wss?uid=swg1JR50241
http://www-01.ibm.com/support/docview.wss?uid=swg21690553
https://exchange.xforce.ibmcloud.com/vulnerabilities/98418

Vulnerability Database

290,278

CVE-2014-6173