CVE-2018-1384: XSS
Published Mar 30, 2018
·Updated
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135.
Affected Software
100 affected components
IBM Business Process Manager=7.5.0.0
IBM Business Process Manager=7.5.0.1
IBM Business Process Manager=7.5.1.0
IBM Business Process Manager=7.5.1.1
IBM Business Process Manager=7.5.1.2
IBM Business Process Manager=8.0.0.0
IBM Business Process Manager=8.0.1.0
IBM Business Process Manager=8.0.1.1
IBM Business Process Manager=8.0.1.2
IBM Business Process Manager=8.0.1.3
IBM Business Process Manager=8.5.0.0
IBM Business Process Manager=8.5.0.1
IBM Business Process Manager=8.5.0.2
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.1
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.7.0
IBM Business Process Manager=8.5.7.0-cf201606
IBM Business Process Manager=8.5.7.0-cf201609
IBM Business Process Manager=8.5.7.0-cf201612
IBM Business Process Manager=8.5.7.0-cf201703
IBM Business Process Manager=8.5.7.0-cf201706
IBM WebSphere Enterprise Service Bus=7.0.0.0
IBM WebSphere Enterprise Service Bus=7.0.0.0
IBM WebSphere Enterprise Service Bus=7.0.0.1
IBM WebSphere Enterprise Service Bus=7.0.0.1
IBM WebSphere Enterprise Service Bus=7.0.0.2
IBM WebSphere Enterprise Service Bus=7.0.0.2
IBM WebSphere Enterprise Service Bus=7.0.0.3
IBM WebSphere Enterprise Service Bus=7.0.0.3
IBM WebSphere Enterprise Service Bus=7.0.0.4
IBM WebSphere Enterprise Service Bus=7.0.0.4
IBM WebSphere Enterprise Service Bus=7.0.0.5
IBM WebSphere Enterprise Service Bus=7.0.0.5
IBM WebSphere Enterprise Service Bus=7.5.0.0
IBM WebSphere Enterprise Service Bus=7.5.0.0
IBM WebSphere Enterprise Service Bus=7.5.0.1
IBM WebSphere Enterprise Service Bus=7.5.0.1
IBM WebSphere Enterprise Service Bus=7.5.1.0
IBM WebSphere Enterprise Service Bus=7.5.1.0
IBM WebSphere Enterprise Service Bus=7.5.1.1
IBM WebSphere Enterprise Service Bus=7.5.1.1
IBM WebSphere Enterprise Service Bus=7.5.1.2
IBM WebSphere Enterprise Service Bus=7.5.1.2
IBM WebSphere Process Server=7.0
IBM WebSphere Process Server=7.0.0.1
IBM WebSphere Process Server=7.0.0.2
IBM WebSphere Process Server=7.0.0.3
IBM WebSphere Process Server=7.0.0.4
IBM WebSphere Process Server=7.0.0.5
IBM Business Process Manager Enterprise Service Bus=8.6.0.0
IBM Business Process Manager=7.5.0.0
IBM Business Process Manager=7.5.0.1
IBM Business Process Manager=7.5.1.0
IBM Business Process Manager=7.5.1.1
IBM Business Process Manager=7.5.1.2
IBM Business Process Manager=8.0.0.0
IBM Business Process Manager=8.0.1.0
IBM Business Process Manager=8.0.1.1
IBM Business Process Manager=8.0.1.2
IBM Business Process Manager=8.0.1.3
IBM Business Process Manager=8.5.0.0
IBM Business Process Manager=8.5.0.1
IBM Business Process Manager=8.5.0.2
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.1
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.7.0
IBM Business Process Manager=8.5.7.0-cf201606
IBM Business Process Manager=8.5.7.0-cf201609
IBM Business Process Manager=8.5.7.0-cf201612
IBM Business Process Manager=8.5.7.0-cf201703
IBM Business Process Manager=8.5.7.0-cf201706
IBM Business Process Manager=8.6.0.0
IBM Business Process Manager=8.6.0.0-cf201712
IBM Business Process Manager=7.5.0.0
IBM Business Process Manager=7.5.0.1
IBM Business Process Manager=7.5.1.0
IBM Business Process Manager=7.5.1.1
IBM Business Process Manager=7.5.1.2
IBM Business Process Manager=8.0.0.0
IBM Business Process Manager=8.0.1.0
IBM Business Process Manager=8.0.1.1
IBM Business Process Manager=8.0.1.2
IBM Business Process Manager=8.0.1.3
IBM Business Process Manager=8.5.0.0
IBM Business Process Manager=8.5.0.1
IBM Business Process Manager=8.5.0.2
IBM Business Process Manager=8.5.5.0
IBM Business Process Manager=8.5.6.0
IBM Business Process Manager=8.5.6.1
IBM Business Process Manager=8.5.6.2
IBM Business Process Manager=8.5.7.0
IBM Business Process Manager=8.5.7.0-cf201606
IBM Business Process Manager=8.5.7.0-cf201609
IBM Business Process Manager=8.5.7.0-cf201612
IBM Business Process Manager=8.5.7.0-cf201703
IBM Business Process Manager=8.5.7.0-cf201706
Event History
Mar 30, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-1384?
CVE-2018-1384 has a medium severity rating due to its potential to allow cross-site scripting attacks.
2
How do I fix CVE-2018-1384?
To fix CVE-2018-1384, upgrade IBM Business Process Manager to a version that has addressed this vulnerability.
3
What impact does CVE-2018-1384 have on my system?
CVE-2018-1384 can lead to arbitrary JavaScript execution, which may result in credential disclosure within trusted sessions.
4
Who is affected by CVE-2018-1384?
CVE-2018-1384 affects multiple versions of IBM Business Process Manager, IBM WebSphere Process Server, and IBM WebSphere Enterprise Service Bus.
5
What version of software is vulnerable according to CVE-2018-1384?
CVE-2018-1384 affects IBM Business Process Manager versions 7.5.0.0 through 8.6.0.0 among others.