Description

Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1048380

https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04

https://github.com/kiegroup/jbpm-wb/compare/6.0.x

Related Vulnerabilities

CVE-2021-43797 Vulnerability in maven package io.netty:netty-codec-http

CVE-2023-37914 Vulnerability in maven package org.xwiki.platform:xwiki-platform-invitation-ui

CVE-2023-29525 Vulnerability in maven package org.xwiki.platform:xwiki-platform-distribution-war

CVE-2017-17837 Vulnerability in maven package org.apache.deltaspike.modules:deltaspike-jsf-module-impl

CVE-2020-6429 Vulnerability in maven package org.webjars.npm:electron

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Patch Release Notes CWE-79