CVE-2016-6343 Cross-site scripting in Dashbuilder

Medium 6.1 Published 31 Oct 2018 Updated 6 Aug 2024

Reflected XSS in JBoss BPM Suite dashbuilder allows attackers to execute scripts in the context of authenticated admin users via malicious links.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2016-6343?

CVE-2016-6343 is a medium-severity cross-site scripting vulnerability in [UNKNOWN] Dashbuilder, published on 31 Oct 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of script code within the context of the affected user.

Weakness: CWE-79

Which versions are affected by CVE-2016-6343?

It affects 1 product.

Products include Redhat Jboss Bpm Suite.

How do I fix CVE-2016-6343?

No fix has been published for CVE-2016-6343 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-6343 being exploited?

There is no known exploitation of CVE-2016-6343 in the wild and no public exploit code.

Sources

Also known as GHSA-6cfp-g7xp-c376.