CVE-2015-0193 Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x throug...
LowCVSS 3.5
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm business process manager | = 7.5.0.0 | No fix listed |
| ibm business process manager | = 7.5.0.1 | No fix listed |
| ibm business process manager | = 7.5.1.0 | No fix listed |
| ibm business process manager | = 7.5.1.1 | No fix listed |
| ibm business process manager | = 7.5.1.2 | No fix listed |
| ibm business process manager | = 8.0.0.0 | No fix listed |
| ibm business process manager | = 8.0.1.0 | No fix listed |
| ibm business process manager | = 8.0.1.1 | No fix listed |
| ibm business process manager | = 8.0.1.2 | No fix listed |
| ibm business process manager | = 8.0.1.3 | No fix listed |
| ibm business process manager | = 8.5.0.0 | No fix listed |
| ibm business process manager | = 8.5.0.1 | No fix listed |
| ibm business process manager | = 8.5.5.0 | No fix listed |
| ibm websphere | = 7.2 | No fix listed |
| ibm websphere | = 7.2.0.1 | No fix listed |
| ibm websphere | = 7.2.0.2 | No fix listed |
| ibm websphere | = 7.2.0.3 | No fix listed |
| ibm websphere | = 7.2.0.4 | No fix listed |
| ibm websphere | = 7.2.0.5 | No fix listed |
References
- JR52626 vendor-advisory
- www-01.ibm.com vendor-advisory