bonitasoft vulnerabilities

Products

• bonita web 3
• bonita bpm portal 2
• bonita-connector-webservice 1
• webservice connector 1

Latest bonitasoft CVEs

Newest publication first

1. CVE-2024-28087 Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability

   Published 2024-05-15

   Medium·CVSS 6.5 EPSS 0.32%

   In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

2. CVE-2024-26542 Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name fi...

   Published 2024-02-27

   Medium·CVSS 6.1 EPSS 0.53%

   Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field.

3. CVE-2020-36640 bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference

   Published 2023-01-05

   Critical·CVSS 9.8 EPSS 0.84%

   A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads...

4. CVE-2022-25237 Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /.....

   Published 2022-05-27

   Critical·CVSS 9.8 EPSS 56.7%

   Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privi...

5. CVE-2015-3898 Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirect...

   Published 2018-02-28

   Medium·CVSS 6.1 EPSS 5.8% Public exploit

   Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.

6. CVE-2015-3897 Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter....

   Published 2015-06-18

   Medium·CVSS 5.0 EPSS 17.6% Public exploit

   Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.