CVE-2014-3075

Published: Sep 4, 2014Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.

Affected (18)

Products: Ibm: Business Process Manager, Websphere Application Server

Ibm

2 products

Business Process Manager

Websphere Application Server

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Ibm Business Process Manager	Version 7.5.0.0
Ibm Business Process Manager	Version 7.5.0.1
Ibm Business Process Manager	Version 7.5.1.0
Ibm Business Process Manager	Version 7.5.1.1
Ibm Business Process Manager	Version 7.5.1.2
Ibm Business Process Manager	Version 8.0.0.0
Ibm Business Process Manager	Version 8.0.1.0
Ibm Business Process Manager	Version 8.0.1.1
Ibm Business Process Manager	Version 8.0.1.2
Ibm Business Process Manager	Version 8.5.0.0
Ibm Business Process Manager	Version 8.5.0.1
Ibm Business Process Manager	Version 8.5.5.0
Ibm Websphere Application Server	Version 7.2.0.1
Ibm Websphere Application Server	Version 7.2.0.2
Ibm Websphere Application Server	Version 7.2.0.3
Ibm Websphere Application Server	Version 7.2.0.4
Ibm Websphere Application Server	Version 7.2.0.5
Ibm Websphere Application Server	Version 7.2