CVE-2017-2674: red hat business-central Improper Input Validation
Vulnerability summary
CVE-2017-2674 is a medium (CVSS 6.1) Improper Input Validation vulnerability in red hat business-central. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 69.8% of scored vulnerabilities.
Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.29%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.29% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Red hat1 product
- business-central6.4.3
Redhat1 product
- jboss_bpm_suite≥ 6.0.0, < 6.4.3
2 vendors · 2 products