Vulnerabilites related to ibm - websphere
cve-2015-0193
Vulnerability from cvelistv5
Published
2015-05-30 19:00
Modified
2024-08-06 04:03
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www-01.ibm.com/support/docview.wss?uid=swg21697944 | x_refsource_CONFIRM | |
| http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626 | vendor-advisory, x_refsource_AIXAPAR |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.074Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697944"
},
{
"name": "JR52626",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-30T18:57:00",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697944"
},
{
"name": "JR52626",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2015-0193",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21697944",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697944"
},
{
"name": "JR52626",
"refsource": "AIXAPAR",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2015-0193",
"datePublished": "2015-05-30T19:00:00",
"dateReserved": "2014-11-18T00:00:00",
"dateUpdated": "2024-08-06T04:03:10.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-0156
Vulnerability from cvelistv5
Published
2015-05-25 14:00
Modified
2024-08-06 04:03
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www-01.ibm.com/support/docview.wss?uid=swg21697120 | x_refsource_CONFIRM | |
| http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812 | vendor-advisory, x_refsource_AIXAPAR | |
| http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420 | vendor-advisory, x_refsource_AIXAPAR |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.435Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697120"
},
{
"name": "IT06812",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812"
},
{
"name": "JR52420",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-25T14:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697120"
},
{
"name": "IT06812",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812"
},
{
"name": "JR52420",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2015-0156",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21697120",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697120"
},
{
"name": "IT06812",
"refsource": "AIXAPAR",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812"
},
{
"name": "JR52420",
"refsource": "AIXAPAR",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2015-0156",
"datePublished": "2015-05-25T14:00:00",
"dateReserved": "2014-11-18T00:00:00",
"dateUpdated": "2024-08-06T04:03:10.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1756
Vulnerability from cvelistv5
Published
2018-03-30 16:00
Modified
2024-09-17 01:31
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/135856 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/103589 | vdb-entry, x_refsource_BID | |
| http://www.ibm.com/support/docview.wss?uid=swg22010796 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Process Manager |
Version: 8.6 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:39:32.302Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135856"
},
{
"name": "103589",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103589"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010796"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.6"
}
]
}
],
"datePublic": "2018-03-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:N/AC:L/AV:L/C:L/I:N/PR:N/S:U/UI:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-04T09:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135856"
},
{
"name": "103589",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103589"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010796"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2018-03-23T00:00:00",
"ID": "CVE-2017-1756",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager",
"version": {
"version_data": [
{
"version_value": "8.6"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "L",
"C": "L",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135856",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135856"
},
{
"name": "103589",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103589"
},
{
"name": "http://www.ibm.com/support/docview.wss?uid=swg22010796",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010796"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2017-1756",
"datePublished": "2018-03-30T16:00:00Z",
"dateReserved": "2016-11-30T00:00:00",
"dateUpdated": "2024-09-17T01:31:39.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-1884
Vulnerability from cvelistv5
Published
2015-06-28 14:00
Modified
2024-08-06 04:54
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1032700 | vdb-entry, x_refsource_SECTRACK | |
| http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957 | vendor-advisory, x_refsource_AIXAPAR | |
| http://www.securitytracker.com/id/1032701 | vdb-entry, x_refsource_SECTRACK | |
| http://www-01.ibm.com/support/docview.wss?uid=swg21700831 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/75360 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:54:16.327Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1032700",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032700"
},
{
"name": "JR52957",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957"
},
{
"name": "1032701",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032701"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21700831"
},
{
"name": "75360",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/75360"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-23T18:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "1032700",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032700"
},
{
"name": "JR52957",
"tags": [
"vendor-advisory",
"x_refsource_AIXAPAR"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957"
},
{
"name": "1032701",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032701"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21700831"
},
{
"name": "75360",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/75360"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2015-1884",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1032700",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032700"
},
{
"name": "JR52957",
"refsource": "AIXAPAR",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957"
},
{
"name": "1032701",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032701"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21700831",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21700831"
},
{
"name": "75360",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/75360"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2015-1884",
"datePublished": "2015-06-28T14:00:00",
"dateReserved": "2015-02-19T00:00:00",
"dateUpdated": "2024-08-06T04:54:16.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1848
Vulnerability from cvelistv5
Published
2018-12-14 15:30
Modified
2024-09-16 23:41
Severity ?
EPSS score ?
Summary
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/150947 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/106217 | vdb-entry, x_refsource_BID | |
| https://www.ibm.com/support/docview.wss?uid=ibm10743005 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | Business Automation Workflow |
Version: 18.0.0.0 Version: 18.0.0.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:38.561Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ibm-baw-cve20181848-xss(150947)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"name": "106217",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Automation Workflow",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "18.0.0.0"
},
{
"status": "affected",
"version": "18.0.0.1"
}
]
}
],
"datePublic": "2018-12-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/A:N/AC:L/AV:N/C:L/I:L/PR:N/S:C/UI:R/E:H/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-12-18T10:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "ibm-baw-cve20181848-xss(150947)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"name": "106217",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2018-12-13T00:00:00",
"ID": "CVE-2018-1848",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Automation Workflow",
"version": {
"version_data": [
{
"version_value": "18.0.0.0"
},
{
"version_value": "18.0.0.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "N",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ibm-baw-cve20181848-xss(150947)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"name": "106217",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106217"
},
{
"name": "https://www.ibm.com/support/docview.wss?uid=ibm10743005",
"refsource": "CONFIRM",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1848",
"datePublished": "2018-12-14T15:30:00Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T23:41:48.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9693
Vulnerability from cvelistv5
Published
2017-03-07 17:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine. IBM Reference #: 1998655.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/98074 | vdb-entry, x_refsource_BID | |
| https://www.ibm.com/support/docview.wss?uid=swg21998655 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM Corporation | Business Process Manager Advanced |
Version: 7.5 Version: 7.5.0.1 Version: 7.5.1 Version: 7.5.1.1 Version: 7.5.1.2 Version: 8.0 Version: 8.0.1 Version: 8.0.1.1 Version: 8.0.1.2 Version: 8.5 Version: 8.5.0.1 Version: 8.5.5 Version: 8.0.1.3 Version: 8.5.6 Version: 8.5.0.2 Version: 8.5.7 Version: 8.5.7.CF201609 Version: 8.5.6.1 Version: 8.5.6.2 Version: 8.5.7.CF201606 Version: 8.5.7.CF201612 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.295Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "98074",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98074"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/docview.wss?uid=swg21998655"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Business Process Manager Advanced",
"vendor": "IBM Corporation",
"versions": [
{
"status": "affected",
"version": "7.5"
},
{
"status": "affected",
"version": "7.5.0.1"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.1.1"
},
{
"status": "affected",
"version": "7.5.1.2"
},
{
"status": "affected",
"version": "8.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.1.1"
},
{
"status": "affected",
"version": "8.0.1.2"
},
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.5.0.1"
},
{
"status": "affected",
"version": "8.5.5"
},
{
"status": "affected",
"version": "8.0.1.3"
},
{
"status": "affected",
"version": "8.5.6"
},
{
"status": "affected",
"version": "8.5.0.2"
},
{
"status": "affected",
"version": "8.5.7"
},
{
"status": "affected",
"version": "8.5.7.CF201609"
},
{
"status": "affected",
"version": "8.5.6.1"
},
{
"status": "affected",
"version": "8.5.6.2"
},
{
"status": "affected",
"version": "8.5.7.CF201606"
},
{
"status": "affected",
"version": "8.5.7.CF201612"
}
]
}
],
"datePublic": "2017-02-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim\u0027s machine. IBM Reference #: 1998655."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-01T09:57:02",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "98074",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98074"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/docview.wss?uid=swg21998655"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2016-9693",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Business Process Manager Advanced",
"version": {
"version_data": [
{
"version_value": "7.5"
},
{
"version_value": "7.5.0.1"
},
{
"version_value": "7.5.1"
},
{
"version_value": "7.5.1.1"
},
{
"version_value": "7.5.1.2"
},
{
"version_value": "8.0"
},
{
"version_value": "8.0.1"
},
{
"version_value": "8.0.1.1"
},
{
"version_value": "8.0.1.2"
},
{
"version_value": "8.5"
},
{
"version_value": "8.5.0.1"
},
{
"version_value": "8.5.5"
},
{
"version_value": "8.0.1.3"
},
{
"version_value": "8.5.6"
},
{
"version_value": "8.5.0.2"
},
{
"version_value": "8.5.7"
},
{
"version_value": "8.5.7.CF201609"
},
{
"version_value": "8.5.6.1"
},
{
"version_value": "8.5.6.2"
},
{
"version_value": "8.5.7.CF201606"
},
{
"version_value": "8.5.7.CF201612"
}
]
}
}
]
},
"vendor_name": "IBM Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim\u0027s machine. IBM Reference #: 1998655."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "98074",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98074"
},
{
"name": "https://www.ibm.com/support/docview.wss?uid=swg21998655",
"refsource": "CONFIRM",
"url": "https://www.ibm.com/support/docview.wss?uid=swg21998655"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2016-9693",
"datePublished": "2017-03-07T17:00:00",
"dateReserved": "2016-12-01T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2018-12-14 16:29
Modified
2024-11-21 04:00
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.securityfocus.com/bid/106217 | Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/150947 | VDB Entry, Vendor Advisory | |
| psirt@us.ibm.com | https://www.ibm.com/support/docview.wss?uid=ibm10743005 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106217 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/150947 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/docview.wss?uid=ibm10743005 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ibm | business_automation_workflow | 18.0.0.0 | |
| ibm | business_automation_workflow | 18.0.0.1 | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | * | |
| ibm | business_process_manager | 8.5.5.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.6.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.5.7.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | business_process_manager | 8.6.0.0 | |
| ibm | websphere | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E2DFAA5-B9A9-42D3-81FA-0815AD7BEE1E",
"versionEndIncluding": "7.5.1.2",
"versionStartIncluding": "7.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58",
"versionEndIncluding": "8.0.1.3",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88",
"versionEndIncluding": "8.5.0.2",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EE77FBBD-0033-4DDC-BBFC-8927C96A2DE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*",
"matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*",
"matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1874008E-86F5-4A15-B4D1-14AB666166ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:*:*:*:*",
"matchCriteriaId": "6D5823F5-B1A9-4695-9F45-04DCA899CA4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:*:*:*:*",
"matchCriteriaId": "9AC6A2C0-3CC1-4DF5-85CB-590565BB2398",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:*:*:*:*",
"matchCriteriaId": "660C60D1-BFFF-4A0C-A69A-4A6006C8D47E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:*:*:*:*",
"matchCriteriaId": "85F23471-D0B9-4D6F-891A-F847A6AAB21C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:*:*:*:*",
"matchCriteriaId": "D2B1150A-E780-42BF-8D9E-77258C1D869A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "04D332A0-BEA8-4E22-A37C-1AC76B36ACDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201712:*:*:*:*:*:*",
"matchCriteriaId": "F7B13D9D-E6BC-4621-A3F2-57F501DC97B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf201803:*:*:*:*:*:*",
"matchCriteriaId": "71A849EF-53B1-4402-85BE-D75E4765AEAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:*:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "F5A1C5CB-2E2F-4A18-9F37-75E0F304FA31",
"versionEndIncluding": "7.2.0.5",
"versionStartIncluding": "7.2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947."
},
{
"lang": "es",
"value": "IBM Business Automation Workflow en sus versiones 18.0.0.0 y 18.0.0.1 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. Esto podr\u00eda dar lugar a una revelaci\u00f3n de credenciales en una sesi\u00f3n de confianza. IBM X-Force ID: 150947."
}
],
"id": "CVE-2018-1848",
"lastModified": "2024-11-21T04:00:29.983",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-14T16:29:00.220",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106217"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150947"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10743005"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-06-28 14:59
Modified
2024-11-21 02:26
Severity ?
Summary
Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42264DE4-CEED-4FA5-8C77-82BF9A55F3F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "91BDDE54-95C6-4E95-9427-D83E61355E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "A7B3E6D1-ADB3-4709-9E02-779EAA7A05E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "1D338AF3-8FE6-4E51-B961-344E157EECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A5E78ECD-6FFA-4AA0-B8B4-F9C002D6F8EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8057C7D0-978D-490B-BE80-597A2CB27A77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "16617000-4388-43EF-AE14-8C108068155F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E4B6A964-F948-4FAA-A6C7-41641AF12504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DAC02B89-813E-4B3D-B518-6565BE06C575",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "3DEBE193-CDE1-406C-9042-4085AA0EED8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "05B6C389-9332-4C33-A3AD-270A54AC564E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "07630F25-A03C-401D-A16A-51B63014C963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "06DFA125-9D52-4C16-9946-DB8D43700415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "EF781F2F-05FB-4DBD-8BC1-98A630CD375A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "17E42B0A-0947-4799-993F-CBF8A84EBD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E95968B6-FF99-4234-9EC7-6EAA9C7DA753",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "613CC0CD-083E-439A-9A53-777E69CDE2DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "0F1442C9-ED96-40C5-BE20-987C928BAD9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "50B6287C-5A45-46B7-A685-93D1CBA0CC83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "3693DBD8-F30F-44D0-A154-4C268120D7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "161542A0-E919-4105-AD4F-C881ACF8D26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E71AC948-9F71-403E-8035-172D5F667B54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "FE68791B-B7AE-4715-810E-0C278E5C363F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "37281A0A-3BE1-4B22-840F-65CA7B8AB360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF8D1DC9-CB5E-4627-8689-B5FA7C5DE1C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E77872E9-D66C-47FF-AA1D-7764D65997A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "00CC8270-5ABE-428C-9090-16EC8298E50C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "446C4FEE-DDB7-41C5-BC9B-7E6B08B074BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32504DEB-7391-4452-BA2E-409959B24222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7B3D03C8-B7F4-43AF-9270-555507AAC527",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "A05F59A1-3063-45ED-B1E8-AABC4FC0A807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "3FC25EB0-CA22-4176-8752-8BD26B111F2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8F74820-DF10-499E-AF7A-93AC285843D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E69BBEFA-B321-4085-AEA1-BAE2B0B54524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "60F679C8-74FB-40F5-A5B8-FBD6BF424379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "7C097D2E-5BB7-4979-A755-E928094A92C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*",
"matchCriteriaId": "BE4F0900-83C3-4228-9F3B-2664C1C816F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*",
"matchCriteriaId": "0DDE4CB3-1162-4A51-8EBA-2A25E8B6898B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*",
"matchCriteriaId": "021FABA7-6B97-4511-8E07-B7A34A387493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "9942841D-3E36-4159-AA5A-B534CB701B6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "783C2592-9669-4C75-9E63-C834482F6F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7A1FCB4E-DC46-4780-9017-1E8E789E785F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "00DC7609-2519-4DB5-AA5E-A1CFCE0DA5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "2D934094-9D9F-4CBC-94F0-82A503D35EBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.1:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "96510E62-70F4-40AB-8DE4-220C833CB306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "041B6ACD-FE0B-4EE0-BCF4-10D4555ED9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.3:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "7D75BE32-0A9B-448F-BE20-E80BD599A14D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.4:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "5B80E411-3F24-4BF0-8B3F-116E0C998E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.5:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "51B1CAA3-E2AA-4284-A0DC-19E9C76A8149",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, 8.5.0 hasta 8.5.0.1, y 8.5.5 hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2 hasta 7.2.0.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a trav\u00e9s de una URL de ficheros de internacionalizaci\u00f3n manipulada."
}
],
"id": "CVE-2015-1884",
"lastModified": "2024-11-21T02:26:20.290",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-06-28T14:59:01.107",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21700831"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/75360"
},
{
"source": "psirt@us.ibm.com",
"url": "http://www.securitytracker.com/id/1032700"
},
{
"source": "psirt@us.ibm.com",
"url": "http://www.securitytracker.com/id/1032701"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21700831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/75360"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1032700"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1032701"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-07 17:59
Modified
2024-11-21 03:01
Severity ?
Summary
IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine. IBM Reference #: 1998655.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42264DE4-CEED-4FA5-8C77-82BF9A55F3F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "91BDDE54-95C6-4E95-9427-D83E61355E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "A7B3E6D1-ADB3-4709-9E02-779EAA7A05E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "1D338AF3-8FE6-4E51-B961-344E157EECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A5E78ECD-6FFA-4AA0-B8B4-F9C002D6F8EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8057C7D0-978D-490B-BE80-597A2CB27A77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "16617000-4388-43EF-AE14-8C108068155F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E4B6A964-F948-4FAA-A6C7-41641AF12504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DAC02B89-813E-4B3D-B518-6565BE06C575",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "3DEBE193-CDE1-406C-9042-4085AA0EED8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "05B6C389-9332-4C33-A3AD-270A54AC564E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "07630F25-A03C-401D-A16A-51B63014C963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "06DFA125-9D52-4C16-9946-DB8D43700415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "EF781F2F-05FB-4DBD-8BC1-98A630CD375A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "17E42B0A-0947-4799-993F-CBF8A84EBD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E95968B6-FF99-4234-9EC7-6EAA9C7DA753",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "613CC0CD-083E-439A-9A53-777E69CDE2DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "0F1442C9-ED96-40C5-BE20-987C928BAD9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "50B6287C-5A45-46B7-A685-93D1CBA0CC83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "3693DBD8-F30F-44D0-A154-4C268120D7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "161542A0-E919-4105-AD4F-C881ACF8D26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E71AC948-9F71-403E-8035-172D5F667B54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "FE68791B-B7AE-4715-810E-0C278E5C363F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "37281A0A-3BE1-4B22-840F-65CA7B8AB360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF8D1DC9-CB5E-4627-8689-B5FA7C5DE1C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E77872E9-D66C-47FF-AA1D-7764D65997A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "00CC8270-5ABE-428C-9090-16EC8298E50C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "446C4FEE-DDB7-41C5-BC9B-7E6B08B074BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32504DEB-7391-4452-BA2E-409959B24222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7B3D03C8-B7F4-43AF-9270-555507AAC527",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "A05F59A1-3063-45ED-B1E8-AABC4FC0A807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "3FC25EB0-CA22-4176-8752-8BD26B111F2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8F74820-DF10-499E-AF7A-93AC285843D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E69BBEFA-B321-4085-AEA1-BAE2B0B54524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "60F679C8-74FB-40F5-A5B8-FBD6BF424379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "7C097D2E-5BB7-4979-A755-E928094A92C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4C12274F-495C-4E81-A317-E66916B0A2F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*",
"matchCriteriaId": "BE4F0900-83C3-4228-9F3B-2664C1C816F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*",
"matchCriteriaId": "0DDE4CB3-1162-4A51-8EBA-2A25E8B6898B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*",
"matchCriteriaId": "021FABA7-6B97-4511-8E07-B7A34A387493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "9942841D-3E36-4159-AA5A-B534CB701B6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "783C2592-9669-4C75-9E63-C834482F6F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7A1FCB4E-DC46-4780-9017-1E8E789E785F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06BDD35B-B0C3-4B90-87E3-19EF561D3722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "19B921EC-DE16-4A2B-BB29-B02A9B416470",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*",
"matchCriteriaId": "8578A0D7-3330-4F79-A934-4940673383A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "CC44A2D4-F3D3-4D98-8FDC-8274E1725800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "00DC7609-2519-4DB5-AA5E-A1CFCE0DA5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "66A4A455-A75B-4363-AC6D-DAD50287EB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:express:*:*:*",
"matchCriteriaId": "D06A925E-C739-48A9-B211-36DE458A7898",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "12DA4BA4-D130-48C2-BCD0-8D76E0BADDBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4B8D43-BD99-499E-B0D4-27BFC997DF70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "66327978-D257-4ADE-8AEA-22547B0E4541",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*",
"matchCriteriaId": "ADE7414F-BF17-4415-95C3-FDBC2BC5C7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "E590C058-EC80-48FB-87C7-3F84E2BC07E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8F88ED9A-7D7F-4C1F-87AA-555C941DE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8736CAA3-7C69-4F8D-936B-2B7B3B5DEED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "CD9103EF-29E7-48E6-ADF4-66D74C3FF427",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "2D934094-9D9F-4CBC-94F0-82A503D35EBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.1:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "96510E62-70F4-40AB-8DE4-220C833CB306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "041B6ACD-FE0B-4EE0-BCF4-10D4555ED9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.3:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "7D75BE32-0A9B-448F-BE20-E80BD599A14D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.4:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "5B80E411-3F24-4BF0-8B3F-116E0C998E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.5:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "51B1CAA3-E2AA-4284-A0DC-19E9C76A8149",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim\u0027s machine. IBM Reference #: 1998655."
},
{
"lang": "es",
"value": "IBM Business Process Manager 7.5, 8.0 y 8.5 tiene una capacidad de descarga de archivos vulnerable a un conjunto de ataques. Por \u00faltimo, un atacante puede provocar que una v\u00edctima no autenticada se descargue una carga \u00fatil maliciosa. Una restricci\u00f3n de tipo de archivo existente puede eludirse para que la carga \u00fatil pueda considerarse ejecutable y provocar da\u00f1os en la m\u00e1quina de la v\u00edctima. Referencia de IBM #: 1998655."
}
],
"id": "CVE-2016-9693",
"lastModified": "2024-11-21T03:01:37.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 3.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-07T17:59:00.210",
"references": [
{
"source": "psirt@us.ibm.com",
"url": "http://www.securityfocus.com/bid/98074"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=swg21998655"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/98074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.ibm.com/support/docview.wss?uid=swg21998655"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-05-30 19:59
Modified
2024-11-21 02:22
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42264DE4-CEED-4FA5-8C77-82BF9A55F3F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "91BDDE54-95C6-4E95-9427-D83E61355E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "A7B3E6D1-ADB3-4709-9E02-779EAA7A05E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "1D338AF3-8FE6-4E51-B961-344E157EECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A5E78ECD-6FFA-4AA0-B8B4-F9C002D6F8EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8057C7D0-978D-490B-BE80-597A2CB27A77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "16617000-4388-43EF-AE14-8C108068155F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E4B6A964-F948-4FAA-A6C7-41641AF12504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DAC02B89-813E-4B3D-B518-6565BE06C575",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "3DEBE193-CDE1-406C-9042-4085AA0EED8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "05B6C389-9332-4C33-A3AD-270A54AC564E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "07630F25-A03C-401D-A16A-51B63014C963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "06DFA125-9D52-4C16-9946-DB8D43700415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "EF781F2F-05FB-4DBD-8BC1-98A630CD375A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "17E42B0A-0947-4799-993F-CBF8A84EBD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E95968B6-FF99-4234-9EC7-6EAA9C7DA753",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "613CC0CD-083E-439A-9A53-777E69CDE2DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "0F1442C9-ED96-40C5-BE20-987C928BAD9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "50B6287C-5A45-46B7-A685-93D1CBA0CC83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "3693DBD8-F30F-44D0-A154-4C268120D7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "161542A0-E919-4105-AD4F-C881ACF8D26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E71AC948-9F71-403E-8035-172D5F667B54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "FE68791B-B7AE-4715-810E-0C278E5C363F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "37281A0A-3BE1-4B22-840F-65CA7B8AB360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF8D1DC9-CB5E-4627-8689-B5FA7C5DE1C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E77872E9-D66C-47FF-AA1D-7764D65997A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "00CC8270-5ABE-428C-9090-16EC8298E50C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "446C4FEE-DDB7-41C5-BC9B-7E6B08B074BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32504DEB-7391-4452-BA2E-409959B24222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7B3D03C8-B7F4-43AF-9270-555507AAC527",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "A05F59A1-3063-45ED-B1E8-AABC4FC0A807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "3FC25EB0-CA22-4176-8752-8BD26B111F2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8F74820-DF10-499E-AF7A-93AC285843D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E69BBEFA-B321-4085-AEA1-BAE2B0B54524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "60F679C8-74FB-40F5-A5B8-FBD6BF424379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "7C097D2E-5BB7-4979-A755-E928094A92C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*",
"matchCriteriaId": "BE4F0900-83C3-4228-9F3B-2664C1C816F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*",
"matchCriteriaId": "0DDE4CB3-1162-4A51-8EBA-2A25E8B6898B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*",
"matchCriteriaId": "021FABA7-6B97-4511-8E07-B7A34A387493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "9942841D-3E36-4159-AA5A-B534CB701B6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "783C2592-9669-4C75-9E63-C834482F6F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7A1FCB4E-DC46-4780-9017-1E8E789E785F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "00DC7609-2519-4DB5-AA5E-A1CFCE0DA5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "2D934094-9D9F-4CBC-94F0-82A503D35EBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.1:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "96510E62-70F4-40AB-8DE4-220C833CB306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "041B6ACD-FE0B-4EE0-BCF4-10D4555ED9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.3:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "7D75BE32-0A9B-448F-BE20-E80BD599A14D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.4:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "5B80E411-3F24-4BF0-8B3F-116E0C998E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.5:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "51B1CAA3-E2AA-4284-A0DC-19E9C76A8149",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, y 8.5.x hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de una URL manipulada que provoca una condici\u00f3n de error."
}
],
"id": "CVE-2015-0193",
"lastModified": "2024-11-21T02:22:30.653",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-05-30T19:59:01.583",
"references": [
{
"source": "psirt@us.ibm.com",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697944"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697944"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-05-25 14:59
Modified
2024-11-21 02:22
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | http://www-01.ibm.com/support/docview.wss?uid=swg21697120 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www-01.ibm.com/support/docview.wss?uid=swg21697120 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "2D934094-9D9F-4CBC-94F0-82A503D35EBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.1:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "96510E62-70F4-40AB-8DE4-220C833CB306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "041B6ACD-FE0B-4EE0-BCF4-10D4555ED9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.3:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "7D75BE32-0A9B-448F-BE20-E80BD599A14D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.4:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "5B80E411-3F24-4BF0-8B3F-116E0C998E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.5:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "51B1CAA3-E2AA-4284-A0DC-19E9C76A8149",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42264DE4-CEED-4FA5-8C77-82BF9A55F3F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "91BDDE54-95C6-4E95-9427-D83E61355E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "A7B3E6D1-ADB3-4709-9E02-779EAA7A05E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "1D338AF3-8FE6-4E51-B961-344E157EECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A5E78ECD-6FFA-4AA0-B8B4-F9C002D6F8EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8057C7D0-978D-490B-BE80-597A2CB27A77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "16617000-4388-43EF-AE14-8C108068155F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E4B6A964-F948-4FAA-A6C7-41641AF12504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DAC02B89-813E-4B3D-B518-6565BE06C575",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "3DEBE193-CDE1-406C-9042-4085AA0EED8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "05B6C389-9332-4C33-A3AD-270A54AC564E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "07630F25-A03C-401D-A16A-51B63014C963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "06DFA125-9D52-4C16-9946-DB8D43700415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "EF781F2F-05FB-4DBD-8BC1-98A630CD375A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "17E42B0A-0947-4799-993F-CBF8A84EBD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E95968B6-FF99-4234-9EC7-6EAA9C7DA753",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "613CC0CD-083E-439A-9A53-777E69CDE2DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "0F1442C9-ED96-40C5-BE20-987C928BAD9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "50B6287C-5A45-46B7-A685-93D1CBA0CC83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "3693DBD8-F30F-44D0-A154-4C268120D7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "161542A0-E919-4105-AD4F-C881ACF8D26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E71AC948-9F71-403E-8035-172D5F667B54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "FE68791B-B7AE-4715-810E-0C278E5C363F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "37281A0A-3BE1-4B22-840F-65CA7B8AB360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF8D1DC9-CB5E-4627-8689-B5FA7C5DE1C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E77872E9-D66C-47FF-AA1D-7764D65997A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "00CC8270-5ABE-428C-9090-16EC8298E50C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "446C4FEE-DDB7-41C5-BC9B-7E6B08B074BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32504DEB-7391-4452-BA2E-409959B24222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7B3D03C8-B7F4-43AF-9270-555507AAC527",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "A05F59A1-3063-45ED-B1E8-AABC4FC0A807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "3FC25EB0-CA22-4176-8752-8BD26B111F2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8F74820-DF10-499E-AF7A-93AC285843D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E69BBEFA-B321-4085-AEA1-BAE2B0B54524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "60F679C8-74FB-40F5-A5B8-FBD6BF424379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "7C097D2E-5BB7-4979-A755-E928094A92C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*",
"matchCriteriaId": "BE4F0900-83C3-4228-9F3B-2664C1C816F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*",
"matchCriteriaId": "0DDE4CB3-1162-4A51-8EBA-2A25E8B6898B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*",
"matchCriteriaId": "021FABA7-6B97-4511-8E07-B7A34A387493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "989C89DF-C6CB-45C9-9592-30A83896BD71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "9942841D-3E36-4159-AA5A-B534CB701B6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "783C2592-9669-4C75-9E63-C834482F6F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7A1FCB4E-DC46-4780-9017-1E8E789E785F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "00DC7609-2519-4DB5-AA5E-A1CFCE0DA5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "66A4A455-A75B-4363-AC6D-DAD50287EB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:express:*:*:*",
"matchCriteriaId": "D06A925E-C739-48A9-B211-36DE458A7898",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "12DA4BA4-D130-48C2-BCD0-8D76E0BADDBA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, y 8.5.x hasta 8.5.6.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de una URL manipulada."
}
],
"id": "CVE-2015-0156",
"lastModified": "2024-11-21T02:22:27.923",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-05-25T14:59:09.590",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697120"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697120"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-30 16:29
Modified
2024-11-21 03:22
Severity ?
4.0 (Medium) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@us.ibm.com | http://www.ibm.com/support/docview.wss?uid=swg22010796 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | http://www.securityfocus.com/bid/103589 | Third Party Advisory, VDB Entry | |
| psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/135856 | VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ibm.com/support/docview.wss?uid=swg22010796 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103589 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/135856 | VDB Entry, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "91BDDE54-95C6-4E95-9427-D83E61355E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8057C7D0-978D-490B-BE80-597A2CB27A77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "3DEBE193-CDE1-406C-9042-4085AA0EED8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "EF781F2F-05FB-4DBD-8BC1-98A630CD375A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "0F1442C9-ED96-40C5-BE20-987C928BAD9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E71AC948-9F71-403E-8035-172D5F667B54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E77872E9-D66C-47FF-AA1D-7764D65997A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7B3D03C8-B7F4-43AF-9270-555507AAC527",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "E69BBEFA-B321-4085-AEA1-BAE2B0B54524",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*",
"matchCriteriaId": "BE4F0900-83C3-4228-9F3B-2664C1C816F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "9942841D-3E36-4159-AA5A-B534CB701B6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "7A1FCB4E-DC46-4780-9017-1E8E789E785F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "19B921EC-DE16-4A2B-BB29-B02A9B416470",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "00DC7609-2519-4DB5-AA5E-A1CFCE0DA5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "66A4A455-A75B-4363-AC6D-DAD50287EB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:advanced:*:*:*",
"matchCriteriaId": "5FD533D8-D3B2-4661-BD35-C48C1C3C47E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:advanced:*:*:*",
"matchCriteriaId": "240E404A-0420-4731-8DFE-076746B14807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:advanced:*:*:*",
"matchCriteriaId": "66327978-D257-4ADE-8AEA-22547B0E4541",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:advanced:*:*:*",
"matchCriteriaId": "8F88ED9A-7D7F-4C1F-87AA-555C941DE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:advanced:*:*:*",
"matchCriteriaId": "E5105E85-7A37-4A2D-9C56-955B7A414560",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:advanced:*:*:*",
"matchCriteriaId": "F2D29466-67FB-4096-9F5C-1CE4C6E9388F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:advanced:*:*:*",
"matchCriteriaId": "33424F24-7A35-489A-B1B8-BEEBC165CDE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:advanced:*:*:*",
"matchCriteriaId": "A9BD1DCB-5A74-4131-818F-62B6D6350D52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:advanced:*:*:*",
"matchCriteriaId": "B6807E40-534F-475E-89CA-9D8D84E501C1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "A7B3E6D1-ADB3-4709-9E02-779EAA7A05E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "16617000-4388-43EF-AE14-8C108068155F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "05B6C389-9332-4C33-A3AD-270A54AC564E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "17E42B0A-0947-4799-993F-CBF8A84EBD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "50B6287C-5A45-46B7-A685-93D1CBA0CC83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "FE68791B-B7AE-4715-810E-0C278E5C363F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*",
"matchCriteriaId": "00CC8270-5ABE-428C-9090-16EC8298E50C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*",
"matchCriteriaId": "A05F59A1-3063-45ED-B1E8-AABC4FC0A807",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*",
"matchCriteriaId": "60F679C8-74FB-40F5-A5B8-FBD6BF424379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*",
"matchCriteriaId": "0DDE4CB3-1162-4A51-8EBA-2A25E8B6898B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8FE10C1D-2077-435A-8C14-2746A685681C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*",
"matchCriteriaId": "EE43BACD-D187-49C9-85D1-51E3F71D2274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:express:*:*:*",
"matchCriteriaId": "8578A0D7-3330-4F79-A934-4940673383A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*",
"matchCriteriaId": "80D84C06-5E93-4DA4-A333-D3CECB7D74E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:express:*:*:*",
"matchCriteriaId": "D06A925E-C739-48A9-B211-36DE458A7898",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:express:*:*:*",
"matchCriteriaId": "32F2F148-4CF2-46BF-AA7D-D019CBA72C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:express:*:*:*",
"matchCriteriaId": "28D39434-BC55-40CC-B02C-68C272C67013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:express:*:*:*",
"matchCriteriaId": "ADE7414F-BF17-4415-95C3-FDBC2BC5C7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:express:*:*:*",
"matchCriteriaId": "8736CAA3-7C69-4F8D-936B-2B7B3B5DEED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:express:*:*:*",
"matchCriteriaId": "54C2CBF0-838B-4F7F-9E63-25053EC6D2E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:express:*:*:*",
"matchCriteriaId": "0D6B3497-1C02-43C0-8B73-9289F7FC00A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:express:*:*:*",
"matchCriteriaId": "7B136A70-552E-4545-853A-BAFD0919D52C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:express:*:*:*",
"matchCriteriaId": "94F5B156-9994-4A1A-A552-FA4108908883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:express:*:*:*",
"matchCriteriaId": "BD42A0F7-540B-4673-AD8C-373A424A27B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:express:*:*:*",
"matchCriteriaId": "542E8F0D-8326-48E1-9D72-C61EF104573D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "1D338AF3-8FE6-4E51-B961-344E157EECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E4B6A964-F948-4FAA-A6C7-41641AF12504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "07630F25-A03C-401D-A16A-51B63014C963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "E95968B6-FF99-4234-9EC7-6EAA9C7DA753",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "3693DBD8-F30F-44D0-A154-4C268120D7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "37281A0A-3BE1-4B22-840F-65CA7B8AB360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "446C4FEE-DDB7-41C5-BC9B-7E6B08B074BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "3FC25EB0-CA22-4176-8752-8BD26B111F2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "7C097D2E-5BB7-4979-A755-E928094A92C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*",
"matchCriteriaId": "021FABA7-6B97-4511-8E07-B7A34A387493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "F6E31F25-6E71-4A5C-A940-0A935AF19035",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "F646DABB-4C10-4308-8169-EC42C358CF41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.0.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "CC44A2D4-F3D3-4D98-8FDC-8274E1725800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "DF7E8429-8750-4D3C-90E1-829031C7C306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "12DA4BA4-D130-48C2-BCD0-8D76E0BADDBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:standard:*:*:*",
"matchCriteriaId": "D67D59BD-B0B2-47A8-8045-7C62721EA081",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.1:*:*:*:standard:*:*:*",
"matchCriteriaId": "570E9DFF-F991-4D14-87F4-F7FE9554E58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.2:*:*:*:standard:*:*:*",
"matchCriteriaId": "E590C058-EC80-48FB-87C7-3F84E2BC07E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:standard:*:*:*",
"matchCriteriaId": "CD9103EF-29E7-48E6-ADF4-66D74C3FF427",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201606:*:*:standard:*:*:*",
"matchCriteriaId": "A30BF550-893B-4F5D-B128-157655B6F8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201609:*:*:standard:*:*:*",
"matchCriteriaId": "82E8F8FF-7C1E-4684-B479-BB3F8EA13B80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201612:*:*:standard:*:*:*",
"matchCriteriaId": "25AFA35A-B7BC-430C-8AF9-73653E6D36B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201703:*:*:standard:*:*:*",
"matchCriteriaId": "6E9348B4-025E-4A86-A3B5-616840F28B58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf201706:*:*:standard:*:*:*",
"matchCriteriaId": "1B8D6782-F9D8-4B89-8C1D-9BB8992BD89F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:business_process_manager_enterprise_service_bus:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EF3FE592-6983-4C3C-8552-B38735CB2D25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.0:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "1D822D62-D3B2-4B71-BD84-4FC15CE7CCC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.1:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "96510E62-70F4-40AB-8DE4-220C833CB306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.2:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "041B6ACD-FE0B-4EE0-BCF4-10D4555ED9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.3:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "7D75BE32-0A9B-448F-BE20-E80BD599A14D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.4:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "5B80E411-3F24-4BF0-8B3F-116E0C998E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:websphere:7.2.0.5:*:*:*:lombardi:*:*:*",
"matchCriteriaId": "51B1CAA3-E2AA-4284-A0DC-19E9C76A8149",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856."
},
{
"lang": "es",
"value": "La versi\u00f3n 8.6 de IBM Business Process Manager permite que las p\u00e1ginas web se almacenen localmente, lo que permite que sean le\u00eddas por otro usuario en el sistema. IBM X-Force ID: 135856."
}
],
"id": "CVE-2017-1756",
"lastModified": "2024-11-21T03:22:19.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.5,
"impactScore": 1.4,
"source": "psirt@us.ibm.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-30T16:29:00.247",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010796"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/103589"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135856"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010796"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/103589"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"VDB Entry",
"Vendor Advisory"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135856"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
var-202102-0625
Vulnerability from variot
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882. Vendor exploits this vulnerability IBM X-Force ID: 194882 Is published as.Information is obtained and denial of service (DoS) It may be put into a state. Authentication is not required to exploit this vulnerability.The specific flaw exists within the EDataGraphImpl class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This product is a platform for JavaEE and Web service applications, as well as the foundation of the IBM WebSphere software platform.
There is a code problem vulnerability in IBM WebSphere Application Server, which stems from improper design or implementation problems in the code development process of network systems or products. No detailed vulnerability details are currently provided
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202102-0625",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "websphere application server",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "9.0.0.0"
},
{
"model": "websphere application server",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "9.0.5.7"
},
{
"model": "websphere application server",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "8.5.5.20"
},
{
"model": "websphere application server",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "7.0.0.0"
},
{
"model": "websphere application server",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "8.5.0.0"
},
{
"model": "websphere application server",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "8.0.0.15"
},
{
"model": "websphere application server",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "8.0.0.0"
},
{
"model": "websphere application server",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "7.0.0.45"
},
{
"model": "websphere application server",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "7.0"
},
{
"model": "websphere application server",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "9.0"
},
{
"model": "websphere application server",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": "websphere application server",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "8.5"
},
{
"model": "websphere application server",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "8.0"
},
{
"model": "websphere",
"scope": null,
"trust": 0.7,
"vendor": "ibm",
"version": null
},
{
"model": "websphere application server",
"scope": null,
"trust": 0.6,
"vendor": "ibm",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "7.0.0.45",
"versionStartIncluding": "7.0.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.0.0.15",
"versionStartIncluding": "8.0.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.5.5.20",
"versionStartIncluding": "8.5.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.0.5.7",
"versionStartIncluding": "9.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-20353"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "r00t4dm at Cloud-Penetrating Arrow Lab and Longofo at Knownsec 404 Team",
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-174"
}
],
"trust": 0.7
},
"cve": "CVE-2021-20353",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.4,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2021-20353",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2021-12641",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "psirt@us.ibm.com",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 8.2,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-20353",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2021-20353",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-20353",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "psirt@us.ibm.com",
"id": "CVE-2021-20353",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2021-20353",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2021-12641",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202102-818",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-20353",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882. Vendor exploits this vulnerability IBM X-Force ID: 194882 Is published as.Information is obtained and denial of service (DoS) It may be put into a state. Authentication is not required to exploit this vulnerability.The specific flaw exists within the EDataGraphImpl class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This product is a platform for JavaEE and Web service applications, as well as the foundation of the IBM WebSphere software platform. \n\r\n\r\nThere is a code problem vulnerability in IBM WebSphere Application Server, which stems from improper design or implementation problems in the code development process of network systems or products. No detailed vulnerability details are currently provided",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "VULMON",
"id": "CVE-2021-20353"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-20353",
"trust": 3.8
},
{
"db": "ZDI",
"id": "ZDI-21-174",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-12478",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2021-12641",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.0500",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.0604",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202102-818",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-20353",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
]
},
"id": "VAR-202102-0625",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-12641"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-12641"
}
]
},
"last_update_date": "2023-12-18T13:37:33.816000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "6413709 IBM\u00a0X-Force\u00a0Exchange",
"trust": 1.5,
"url": "https://www.ibm.com/support/pages/node/6413709"
},
{
"title": "Patch for IBM WebSphere Application Server code issue vulnerability (CNVD-2021-12641)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/249176"
},
{
"title": "IBM: Security Bulletin: Embedded WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability affects Content Collector for Email",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=0b3149fa33d2f3116cd22786008cb68c"
},
{
"title": "IBM: Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring installed WebSphere Application Server",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=4305f48370e86ab4dffc49951e127055"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-611",
"trust": 1.0
},
{
"problemtype": "XML Improper restrictions on external entity references (CWE-611) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.ibm.com/support/pages/node/6413709"
},
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-21-174/"
},
{
"trust": 2.3,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/194882"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20353"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-identity-manager-is-affected-by-xml-external-entity-xxe-injection-vulnerability-vulnerability-in-websphere-application-server-cve-2021-20353/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-server-is-vulnerable-to-an-xml-external-entity-xxe-injection-vulnerability-cve-2021-20353/"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/websphere-as-external-xml-entity-injection-34536"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.0500"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-affect-ibm-tivoli-monitoring-installed-websphere-application-server/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.0604"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/611.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-embedded-websphere-application-server-is-vulnerable-to-an-xml-external-entity-xxe-injection-vulnerability-affects-content-collector-for-email/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-10T00:00:00",
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"date": "2021-02-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"date": "2021-02-10T00:00:00",
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"date": "2021-10-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"date": "2021-02-10T17:15:22.333000",
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"date": "2021-02-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-10T00:00:00",
"db": "ZDI",
"id": "ZDI-21-174"
},
{
"date": "2021-02-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2021-12641"
},
{
"date": "2021-02-11T00:00:00",
"db": "VULMON",
"id": "CVE-2021-20353"
},
{
"date": "2021-10-20T09:06:00",
"db": "JVNDB",
"id": "JVNDB-2021-003234"
},
{
"date": "2021-02-11T23:03:39.650000",
"db": "NVD",
"id": "CVE-2021-20353"
},
{
"date": "2021-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM\u00a0WebSphere\u00a0Application\u00a0Server\u00a0 In \u00a0XML\u00a0 External entity vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003234"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202102-818"
}
],
"trust": 0.6
}
}