cnvd - cnvd-2016-11750

CNVD-2016-11750

Vulnerability from cnvd - Published: 2016-12-02

Title

Red Hat JBoss BRMS和BPM Suite不完全修复HTML注入漏洞

Description

Red Hat JBoss BRMS和BPM Suite都是美国红帽（Red Hat）公司的产品。前者是一套企业级业务规则管理系统平台，后者是一套集合了JBoss BRMS所有功能的业务流程管理平台。 Red Hat JBoss BRMS和BPM Suite中存在HTML注入漏洞。由于程序未能充分过滤用户提交的数据。攻击者可利用该漏洞在受影响上下文中执行任意代码。

Severity

中

Patch Name

Red Hat JBoss BRMS和BPM Suite不完全修复HTML注入漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://rhn.redhat.com/errata/RHSA-2016-2823.html

Reference

http://www.securityfocus.com/bid/94568

Impacted products

Name
['Red Hat JBoss BPM Suite 6.0.0', 'Red Hat JBoss BRMS 6.0.0', 'Red Hat JBoss BRMS 6.3.1', 'Red Hat JBoss BRMS 6.1', 'Red Hat JBoss BRMS 6.3', 'Red Hat JBoss BRMS 6.0.3', 'Red Hat JBoss BRMS 6.0.2', 'Red Hat JBoss BRMS 6.0.1', 'Red Hat JBoss BPM Suite 6.3.3', 'Red Hat JBoss BPM Suite 6.3.2', 'Red Hat JBoss BPM Suite 6.3.1', 'Red Hat JBoss BPM Suite 6.1', 'Red Hat JBoss BPM Suite 6.0.3', 'Red Hat JBoss BPM Suite 6.3.0', 'Red Hat JBoss BPM Suite 6.1.2', 'Red Hat JBoss BPM Suite 6.0.1']

Name

['Red Hat JBoss BPM Suite 6.0.0', 'Red Hat JBoss BRMS 6.0.0', 'Red Hat JBoss BRMS 6.3.1', 'Red Hat JBoss BRMS 6.1', 'Red Hat JBoss BRMS 6.3', 'Red Hat JBoss BRMS 6.0.3', 'Red Hat JBoss BRMS 6.0.2', 'Red Hat JBoss BRMS 6.0.1', 'Red Hat JBoss BPM Suite 6.3.3', 'Red Hat JBoss BPM Suite 6.3.2', 'Red Hat JBoss BPM Suite 6.3.1', 'Red Hat JBoss BPM Suite 6.1', 'Red Hat JBoss BPM Suite 6.0.3', 'Red Hat JBoss BPM Suite 6.3.0', 'Red Hat JBoss BPM Suite 6.1.2', 'Red Hat JBoss BPM Suite 6.0.1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94568"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-8608"
    }
  },
  "description": "Red Hat JBoss BRMS\u548cBPM Suite\u90fd\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u5957\u4f01\u4e1a\u7ea7\u4e1a\u52a1\u89c4\u5219\u7ba1\u7406\u7cfb\u7edf\u5e73\u53f0\uff0c\u540e\u8005\u662f\u4e00\u5957\u96c6\u5408\u4e86JBoss BRMS\u6240\u6709\u529f\u80fd\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\u3002\r\n\r\nRed Hat JBoss BRMS\u548cBPM Suite\u4e2d\u5b58\u5728HTML\u6ce8\u5165\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684\u6570\u636e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Kirill Gaevskii",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://rhn.redhat.com/errata/RHSA-2016-2823.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11750",
  "openTime": "2016-12-02",
  "patchDescription": "Red Hat JBoss BRMS\u548cBPM Suite\u90fd\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u5957\u4f01\u4e1a\u7ea7\u4e1a\u52a1\u89c4\u5219\u7ba1\u7406\u7cfb\u7edf\u5e73\u53f0\uff0c\u540e\u8005\u662f\u4e00\u5957\u96c6\u5408\u4e86JBoss BRMS\u6240\u6709\u529f\u80fd\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\u3002\r\n\r\nRed Hat JBoss BRMS\u548cBPM Suite\u4e2d\u5b58\u5728HTML\u6ce8\u5165\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684\u6570\u636e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Red Hat JBoss BRMS\u548cBPM Suite\u4e0d\u5b8c\u5168\u4fee\u590dHTML\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Red Hat JBoss BPM Suite 6.0.0",
      "Red Hat JBoss BRMS 6.0.0",
      "Red Hat JBoss BRMS 6.3.1",
      "Red Hat JBoss BRMS  6.1",
      "Red Hat JBoss BRMS  6.3",
      "Red Hat JBoss BRMS  6.0.3",
      "Red Hat JBoss BRMS  6.0.2",
      "Red Hat JBoss BRMS  6.0.1",
      "Red Hat JBoss BPM Suite 6.3.3",
      "Red Hat JBoss BPM Suite  6.3.2",
      "Red Hat JBoss BPM Suite  6.3.1",
      "Red Hat JBoss BPM Suite  6.1",
      "Red Hat JBoss BPM Suite  6.0.3",
      "Red Hat JBoss BPM Suite  6.3.0",
      "Red Hat JBoss BPM Suite  6.1.2",
      "Red Hat JBoss BPM Suite  6.0.1"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94568",
  "serverity": "\u4e2d",
  "submitTime": "2016-11-30",
  "title": "Red Hat JBoss BRMS\u548cBPM Suite\u4e0d\u5b8c\u5168\u4fee\u590dHTML\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2016-8608 (GCVE-0-2016-8608)

Vulnerability from cvelistv5 – Published: 2018-08-01 14:00 – Updated: 2024-08-06 02:27

Summary

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Assigner

redhat

References

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2016-2822.html	vendor-advisoryx_refsource_REDHAT
	http://www.securityfocus.com/bid/94568	vdb-entryx_refsource_BID
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2016-2823.html	vendor-advisoryx_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	Red Hat	BRMS	Affected: 6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:2822",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
          },
          {
            "name": "94568",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94568"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608"
          },
          {
            "name": "RHSA-2016:2823",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BRMS",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "6"
            }
          ]
        }
      ],
      "datePublic": "2016-11-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-02T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:2822",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
        },
        {
          "name": "94568",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94568"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608"
        },
        {
          "name": "RHSA-2016:2823",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-8608",
    "datePublished": "2018-08-01T14:00:00",
    "dateReserved": "2016-10-12T00:00:00",
    "dateUpdated": "2024-08-06T02:27:40.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-11750

CVE-2016-8608 (GCVE-0-2016-8608)

Tags

Sightings

Nomenclature