CVE-2014-0868

2014-07-0711:01:00

CWE-20

[email protected]

web.nvd.nist.gov

ibm

algo credit limits

aclm

cve-2014-0868

xml

input validation

5.9 Medium

AI Score

Confidence

Low

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:P/A:P

0.002 Low

EPSS

Percentile

60.9%

JSON

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by manipulation of read-only limit data.

CPENameOperatorVersion
ibm:algorithmicsibm algorithmicseq-
ibm:algo_credit_limitsibm algo credit limitseq4.7.0
ibm:algo_credit_limitsibm algo credit limitseq4.5.0