Medium severity · published Dec 19, 2017
CVE-2013-6465
Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task…
5.4
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JB
Jbpm · Redhat
6.0.0; 6.0.0; 6.0.0; 6.0.0; 6.0.0; 6.0.0; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6465
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1048380
Patch
https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04
Release Notes
https://github.com/kiegroup/jbpm-wb/compare/6.0.x
More from Jbpm
6.5
CVE-2017-7545
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files
4.3
CVE-2021-20306
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final
–
CVE-2014-8125
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted…