CVE-2015-8524: XSS
Published Feb 29, 2016
·Updated
Cross-site scripting (XSS) vulnerability in Process Portal in IBM Business Process Manager 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Software
18 affected components
IBM Business Process Manager=8.5.0.0
IBM Business Process Manager=8.5.0.0
IBM Business Process Manager=8.5.0.0
IBM Business Process Manager=8.5.0.1
IBM Business Process Manager=8.5.0.1
IBM Business Process Manager=8.5.0.1
IBM Business Process Manager=8.5.0.2
IBM Business Process Manager=8.5.0.2
IBM Business Process Manager=8.5.0.2
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.6.2
Event History
Feb 29, 2016
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8524?
CVE-2015-8524 is considered a high-severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2015-8524?
To fix CVE-2015-8524, upgrade to a patched version of IBM Business Process Manager that addresses this vulnerability.
3
Who is affected by CVE-2015-8524?
CVE-2015-8524 affects users of IBM Business Process Manager versions from 8.5.0.0 to 8.5.6.2.
4
What can attackers do with CVE-2015-8524?
Attackers exploiting CVE-2015-8524 can inject arbitrary web scripts or HTML into affected applications.
5
Is CVE-2015-8524 remotely exploitable?
Yes, CVE-2015-8524 can be exploited remotely through a crafted URL.