CVE-2014-8913

Vulnerability

IBM Business Process Manager (BPM) Process Portal versions 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 are vulnerable to a stored or reflected cross-site scripting (XSS) issue due to improper validation of user-supplied input [1][3]. The vulnerability exists in the Process Portal component and can be triggered via a specially crafted URL.

Exploitation

An attacker must be a remote authenticated user with access to the Process Portal. By crafting a malicious URL containing script code and tricking another authenticated user into clicking it, the attacker can execute arbitrary web script or HTML in the victim's browser within the security context of the hosting web site [1][3]. No additional privileges are required beyond authentication.

Impact

Successful exploitation allows the attacker to steal the victim's cookie-based authentication credentials, leading to session hijacking and unauthorized access to the BPM environment [1][3]. The impact is limited to confidentiality and integrity of the user's session; the CVSS base score is 3.5 (low) [1].

Mitigation

IBM released fixes for affected versions: V8.0.1.3, V8.5.0.0, V8.5.0.1, and V8.5.5.0 via APAR JR51742 [3]. Users should apply the fix from IBM Fix Central. No workaround is documented; the fix sanitizes parameters to prevent script injection [3].