Lucene search

IbmCVE-2014-3040

HistoryAug 26, 2014 - 10:55 a.m.

CVE-2014-3040

2014-08-2610:55:04

CWE-352

ibm

web.nvd.nist.gov

ibm

emptoris

csrf

vulnerability

security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

Confidence

High

EPSS

0.001

Percentile

51.2%

JSON

Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before 10.0.2.2 iFix 2; Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4; and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Affected configurations

Nvd

Node

ibmemptoris_spend_analysisMatch9.5.0.0

ibmemptoris_spend_analysisMatch9.5.0.1

ibmemptoris_spend_analysisMatch9.5.0.2

ibmemptoris_spend_analysisMatch9.5.0.3

ibmemptoris_spend_analysisMatch10.0.0.0

ibmemptoris_spend_analysisMatch10.0.0.1

ibmemptoris_spend_analysisMatch10.0.1.0

ibmemptoris_spend_analysisMatch10.0.1.1

ibmemptoris_spend_analysisMatch10.0.1.2

ibmemptoris_spend_analysisMatch10.0.2.0

ibmemptoris_spend_analysisMatch10.0.2.2

Node

ibmemptoris_sourcing_portfolioMatch9.5.0.0

ibmemptoris_sourcing_portfolioMatch9.5.0.1

ibmemptoris_sourcing_portfolioMatch9.5.0.2

ibmemptoris_sourcing_portfolioMatch9.5.1.0

ibmemptoris_sourcing_portfolioMatch9.5.1.1

ibmemptoris_sourcing_portfolioMatch9.5.1.2

ibmemptoris_sourcing_portfolioMatch10.0.0.0

ibmemptoris_sourcing_portfolioMatch10.0.1.0

ibmemptoris_sourcing_portfolioMatch10.0.1.1

ibmemptoris_sourcing_portfolioMatch10.0.1.2

ibmemptoris_sourcing_portfolioMatch10.0.2.0

ibmemptoris_sourcing_portfolioMatch10.0.2.2

ibmemptoris_sourcing_portfolioMatch10.0.2.3

Node

ibmemptoris_contract_managementMatch9.5.0.0

ibmemptoris_contract_managementMatch9.5.0.1

ibmemptoris_contract_managementMatch9.5.0.2

ibmemptoris_contract_managementMatch9.5.0.3

ibmemptoris_contract_managementMatch9.5.0.4

ibmemptoris_contract_managementMatch9.5.0.5

ibmemptoris_contract_managementMatch9.5.0.6

ibmemptoris_contract_managementMatch10.0.0.0

ibmemptoris_contract_managementMatch10.0.0.1

ibmemptoris_contract_managementMatch10.0.1.0

ibmemptoris_contract_managementMatch10.0.1.1

ibmemptoris_contract_managementMatch10.0.1.2

ibmemptoris_contract_managementMatch10.0.1.3

ibmemptoris_contract_managementMatch10.0.1.5

ibmemptoris_contract_managementMatch10.0.2.0

ibmemptoris_contract_managementMatch10.0.2.1

ibmemptoris_contract_managementMatch10.0.2.2

VendorProductVersionCPE
ibmemptoris_spend_analysis9.5.0.0cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.0:*:*:*:*:*:*:*
ibmemptoris_spend_analysis9.5.0.1cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.1:*:*:*:*:*:*:*
ibmemptoris_spend_analysis9.5.0.2cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.2:*:*:*:*:*:*:*
ibmemptoris_spend_analysis9.5.0.3cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.3:*:*:*:*:*:*:*
ibmemptoris_spend_analysis10.0.0.0cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.0.0:*:*:*:*:*:*:*
ibmemptoris_spend_analysis10.0.0.1cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.0.1:*:*:*:*:*:*:*
ibmemptoris_spend_analysis10.0.1.0cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.1.0:*:*:*:*:*:*:*
ibmemptoris_spend_analysis10.0.1.1cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.1.1:*:*:*:*:*:*:*
ibmemptoris_spend_analysis10.0.1.2cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.1.2:*:*:*:*:*:*:*
ibmemptoris_spend_analysis10.0.2.0cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	emptoris_spend_analysis	9.5.0.0	cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.0:::::::*
ibm	emptoris_spend_analysis	9.5.0.1	cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.1:::::::*
ibm	emptoris_spend_analysis	9.5.0.2	cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.2:::::::*
ibm	emptoris_spend_analysis	9.5.0.3	cpe:2.3:a:ibm:emptoris_spend_analysis:9.5.0.3:::::::*
ibm	emptoris_spend_analysis	10.0.0.0	cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.0.0:::::::*
ibm	emptoris_spend_analysis	10.0.0.1	cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.0.1:::::::*
ibm	emptoris_spend_analysis	10.0.1.0	cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.1.0:::::::*
ibm	emptoris_spend_analysis	10.0.1.1	cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.1.1:::::::*
ibm	emptoris_spend_analysis	10.0.1.2	cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.1.2:::::::*
ibm	emptoris_spend_analysis	10.0.2.0	cpe:2.3:a:ibm:emptoris_spend_analysis:10.0.2.0:::::::*

Rows per page:

1-10 of 411

References

secunia.com/advisories/60479

secunia.com/advisories/60480

secunia.com/advisories/60481

www-01.ibm.com/support/docview.wss?uid=swg21680370

www-01.ibm.com/support/docview.wss?uid=swg21680665

www-01.ibm.com/support/docview.wss?uid=swg21681277

exchange.xforce.ibmcloud.com/vulnerabilities/93306

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

Confidence

High

EPSS

0.001

Percentile

51.2%

JSON

Related for CVE-2014-3040