Lucene search

IbmCVE-2018-1362

HistoryJan 19, 2018 - 2:29 p.m.

CVE-2018-1362

2018-01-1914:29:00

ibm

web.nvd.nist.gov

ibm

curam

social program management

citizen portal

vulnerability

cve-2018-1362

nvd

privilege escalation

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user’s submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380.

Affected configurations

Nvd

Vulners

Node

ibmcuram_social_program_managementMatch6.0.5

ibmcuram_social_program_managementMatch6.1.1.0

ibmcuram_social_program_managementMatch6.2.0.0

ibmcuram_social_program_managementMatch7.0.1

VendorProductVersionCPE
ibmcuram_social_program_management6.0.5cpe:2.3:a:ibm:curam_social_program_management:6.0.5:*:*:*:*:*:*:*
ibmcuram_social_program_management6.1.1.0cpe:2.3:a:ibm:curam_social_program_management:6.1.1.0:*:*:*:*:*:*:*
ibmcuram_social_program_management6.2.0.0cpe:2.3:a:ibm:curam_social_program_management:6.2.0.0:*:*:*:*:*:*:*
ibmcuram_social_program_management7.0.1cpe:2.3:a:ibm:curam_social_program_management:7.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	curam_social_program_management	6.0.5	cpe:2.3:a:ibm:curam_social_program_management:6.0.5:::::::*
ibm	curam_social_program_management	6.1.1.0	cpe:2.3:a:ibm:curam_social_program_management:6.1.1.0:::::::*
ibm	curam_social_program_management	6.2.0.0	cpe:2.3:a:ibm:curam_social_program_management:6.2.0.0:::::::*
ibm	curam_social_program_management	7.0.1	cpe:2.3:a:ibm:curam_social_program_management:7.0.1:::::::*

CNA Affected

[
  {
    "product": "Cram Social Program Management",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.5"
      },
      {
        "status": "affected",
        "version": "6.1.1"
      },
      {
        "status": "affected",
        "version": "6.2.0"
      },
      {
        "status": "affected",
        "version": "7.0.1"
      }
    ]
  }
]

References

www.ibm.com/support/docview.wss?uid=swg22012528

exchange.xforce.ibmcloud.com/vulnerabilities/137380

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

Related for CVE-2018-1362