CVE-2013-6465

Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
redhatjbpm
6.0.0
redhatjbpm
6.0.0:alpha7
redhatjbpm
6.0.0:alpha9
redhatjbpm
6.0.0:beta1
redhatjbpm
6.0.0:beta2
redhatjbpm
6.0.0:beta3
redhatjbpm
6.0.0:beta4
redhatjbpm
6.0.0:beta5
redhatjbpm
6.0.0:cr1
redhatjbpm
6.0.0:cr2
redhatjbpm
6.0.0:cr3
redhatjbpm
6.0.0:cr4
redhatjbpm
6.0.0:cr5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1048380
https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04
https://github.com/kiegroup/jbpm-wb/compare/6.0.x
https://bugzilla.redhat.com/show_bug.cgi?id=1048380
https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04
https://github.com/kiegroup/jbpm-wb/compare/6.0.x