CVE-2015-0193: XSS
First published: Sat May 30 2015(Updated: )
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Business Process Manager | =7.5.0.0 | |
| IBM Business Process Manager | =7.5.0.0 | |
| IBM Business Process Manager | =7.5.0.0 | |
| IBM Business Process Manager | =7.5.0.0 | |
| IBM Business Process Manager | =7.5.0.1 | |
| IBM Business Process Manager | =7.5.0.1 | |
| IBM Business Process Manager | =7.5.0.1 | |
| IBM Business Process Manager | =7.5.0.1 | |
| IBM Business Process Manager | =7.5.1.0 | |
| IBM Business Process Manager | =7.5.1.0 | |
| IBM Business Process Manager | =7.5.1.0 | |
| IBM Business Process Manager | =7.5.1.0 | |
| IBM Business Process Manager | =7.5.1.1 | |
| IBM Business Process Manager | =7.5.1.1 | |
| IBM Business Process Manager | =7.5.1.1 | |
| IBM Business Process Manager | =7.5.1.1 | |
| IBM Business Process Manager | =7.5.1.2 | |
| IBM Business Process Manager | =7.5.1.2 | |
| IBM Business Process Manager | =7.5.1.2 | |
| IBM Business Process Manager | =7.5.1.2 | |
| IBM Business Process Manager | =8.0.0.0 | |
| IBM Business Process Manager | =8.0.0.0 | |
| IBM Business Process Manager | =8.0.0.0 | |
| IBM Business Process Manager | =8.0.0.0 | |
| IBM Business Process Manager | =8.0.1.0 | |
| IBM Business Process Manager | =8.0.1.0 | |
| IBM Business Process Manager | =8.0.1.0 | |
| IBM Business Process Manager | =8.0.1.0 | |
| IBM Business Process Manager | =8.0.1.1 | |
| IBM Business Process Manager | =8.0.1.1 | |
| IBM Business Process Manager | =8.0.1.1 | |
| IBM Business Process Manager | =8.0.1.1 | |
| IBM Business Process Manager | =8.0.1.2 | |
| IBM Business Process Manager | =8.0.1.2 | |
| IBM Business Process Manager | =8.0.1.2 | |
| IBM Business Process Manager | =8.0.1.2 | |
| IBM Business Process Manager | =8.0.1.3 | |
| IBM Business Process Manager | =8.0.1.3 | |
| IBM Business Process Manager | =8.0.1.3 | |
| IBM Business Process Manager | =8.5.0.0 | |
| IBM Business Process Manager | =8.5.0.0 | |
| IBM Business Process Manager | =8.5.0.0 | |
| IBM Business Process Manager | =8.5.0.0 | |
| IBM Business Process Manager | =8.5.0.1 | |
| IBM Business Process Manager | =8.5.0.1 | |
| IBM Business Process Manager | =8.5.0.1 | |
| IBM Business Process Manager | =8.5.0.1 | |
| IBM Business Process Manager | =8.5.5.0 | |
| IBM Business Process Manager | =8.5.5.0 | |
| IBM Business Process Manager | =8.5.5.0 | |
| IBM Business Process Manager | =8.5.5.0 | |
| IBM WebSphere | =7.2 | |
| IBM WebSphere | =7.2.0.1 | |
| IBM WebSphere | =7.2.0.2 | |
| IBM WebSphere | =7.2.0.3 | |
| IBM WebSphere | =7.2.0.4 | |
| IBM WebSphere | =7.2.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-0193?
The severity of CVE-2015-0193 is generally rated as medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2015-0193?
To fix CVE-2015-0193, you should upgrade to the latest versions of IBM Business Process Manager or IBM WebSphere Lombardi that address this vulnerability.
What software is affected by CVE-2015-0193?
CVE-2015-0193 affects IBM Business Process Manager versions 7.5.x, 8.0.x, and 8.5.x, as well as WebSphere Lombardi Edition 7.2.x.
What type of vulnerability is CVE-2015-0193?
CVE-2015-0193 is classified as a cross-site scripting (XSS) vulnerability.
Can remote users exploit CVE-2015-0193?
Yes, remote authenticated users can exploit CVE-2015-0193 by injecting arbitrary web scripts or HTML via crafted URLs.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- vendor/ibm
- canonical/ibm business process manager
- version/ibm business process manager/7.5.0.0
- version/ibm business process manager/7.5.0.1
- version/ibm business process manager/7.5.1.0
- version/ibm business process manager/7.5.1.1
- version/ibm business process manager/7.5.1.2
- version/ibm business process manager/8.0.0.0
- version/ibm business process manager/8.0.1.0
- version/ibm business process manager/8.0.1.1
- version/ibm business process manager/8.0.1.2
- version/ibm business process manager/8.0.1.3
- version/ibm business process manager/8.5.0.0
- version/ibm business process manager/8.5.0.1
- version/ibm business process manager/8.5.5.0
- canonical/ibm websphere
- version/ibm websphere/7.2
- version/ibm websphere/7.2.0.1
- version/ibm websphere/7.2.0.2
- version/ibm websphere/7.2.0.3
- version/ibm websphere/7.2.0.4
- version/ibm websphere/7.2.0.5