JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via dashbuilder. Remote, authenticated attackers that have privileges to access dashbuilder (usually admins) can store scripts in several editable fields, which are not properly sanitized before showing to other users, including other admins.
Multiple stored XSS have been found in admin pages in jbpms 6.3.2 dashbuilder.
The vulnerable points are only accessible by admins so the risk is low, however, attackers may be able to exploit them combining with other vulnerabilities.
Name: Jeremy Choi (Red Hat Product Security Team)
This issue has been addressed in the following products:
Red Hat JBoss BPM Suite 6.4.1
Via RHSA-2017:0249 https://rhn.redhat.com/errata/RHSA-2017-0249.html