Description

Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1048380

https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04

https://github.com/kiegroup/jbpm-wb/compare/6.0.x

Related Vulnerabilities

CVE-2019-10241 Vulnerability in maven package org.eclipse.jetty.aggregate:jetty-all

CVE-2020-26939 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15on

CVE-2020-16022 Vulnerability in maven package org.webjars.npm:electron

CVE-2017-12645 Vulnerability in maven package com.liferay.portal:com.liferay.portal.impl

CVE-2017-16115 Vulnerability in npm package timespan

Severity

Medium

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Patch Release Notes