Red Hat Security AdvisoryRHSA-2017:0557
Red Hat JBoss BPM Suite security update
Released 2017-03-16 · Red Hat rating Moderate · View on Red Hat →
Fixes 3 records
Priority MEDIUM 40
The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to (1) bypass CSRF prot…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01126 · Published 2016-09-07 · Partial fix CWE-352
Priority LOW 32
It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to inte…
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0148 · Published 2018-07-27 · Partial fix CWE-20
Priority LOW 31
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0166 · Published 2018-10-31 · Partial fix CWE-79
