CVE-2017-7463

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-27 · updated 2026-06-17
Weakness: CWE-79

Description

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes an error message to appear that includes part of the bad XML code verbatim without filtering out scripts. Successful exploitation would allow execution of script code within the context of the affected user.

Affected products

RedHat Jboss Bpm Suite: from 6.0.0 before 6.4.3 — fixed in 6.4.3

How to fix

Upgrade to a fixed version: RedHat Jboss Bpm Suite 6.4.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/98385
https://access.redhat.com/errata/RHSA-2017:1217
https://access.redhat.com/errata/RHSA-2017:1218
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7463
http://www.securityfocus.com/bid/98385
https://access.redhat.com/errata/RHSA-2017:1217
https://access.redhat.com/errata/RHSA-2017:1218
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7463

Get alerted when CVE-2017-7463 or the next vulnerability affects your stack