Lucene search

K
cve[email protected]CVE-2014-3040
HistoryAug 26, 2014 - 10:55 a.m.

CVE-2014-3040

2014-08-2610:55:04
CWE-352
web.nvd.nist.gov
17
ibm
emptoris
csrf
vulnerability
security
nvd

9 High

AI Score

Confidence

High

6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

51.2%

Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before 10.0.2.2 iFix 2; Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4; and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Affected configurations

NVD
Node
ibmemptoris_spend_analysisMatch9.5.0.0
OR
ibmemptoris_spend_analysisMatch9.5.0.1
OR
ibmemptoris_spend_analysisMatch9.5.0.2
OR
ibmemptoris_spend_analysisMatch9.5.0.3
OR
ibmemptoris_spend_analysisMatch10.0.0.0
OR
ibmemptoris_spend_analysisMatch10.0.0.1
OR
ibmemptoris_spend_analysisMatch10.0.1.0
OR
ibmemptoris_spend_analysisMatch10.0.1.1
OR
ibmemptoris_spend_analysisMatch10.0.1.2
OR
ibmemptoris_spend_analysisMatch10.0.2.0
OR
ibmemptoris_spend_analysisMatch10.0.2.2
Node
ibmemptoris_sourcing_portfolioMatch9.5.0.0
OR
ibmemptoris_sourcing_portfolioMatch9.5.0.1
OR
ibmemptoris_sourcing_portfolioMatch9.5.0.2
OR
ibmemptoris_sourcing_portfolioMatch9.5.1.0
OR
ibmemptoris_sourcing_portfolioMatch9.5.1.1
OR
ibmemptoris_sourcing_portfolioMatch9.5.1.2
OR
ibmemptoris_sourcing_portfolioMatch10.0.0.0
OR
ibmemptoris_sourcing_portfolioMatch10.0.1.0
OR
ibmemptoris_sourcing_portfolioMatch10.0.1.1
OR
ibmemptoris_sourcing_portfolioMatch10.0.1.2
OR
ibmemptoris_sourcing_portfolioMatch10.0.2.0
OR
ibmemptoris_sourcing_portfolioMatch10.0.2.2
OR
ibmemptoris_sourcing_portfolioMatch10.0.2.3
Node
ibmemptoris_contract_managementMatch9.5.0.0
OR
ibmemptoris_contract_managementMatch9.5.0.1
OR
ibmemptoris_contract_managementMatch9.5.0.2
OR
ibmemptoris_contract_managementMatch9.5.0.3
OR
ibmemptoris_contract_managementMatch9.5.0.4
OR
ibmemptoris_contract_managementMatch9.5.0.5
OR
ibmemptoris_contract_managementMatch9.5.0.6
OR
ibmemptoris_contract_managementMatch10.0.0.0
OR
ibmemptoris_contract_managementMatch10.0.0.1
OR
ibmemptoris_contract_managementMatch10.0.1.0
OR
ibmemptoris_contract_managementMatch10.0.1.1
OR
ibmemptoris_contract_managementMatch10.0.1.2
OR
ibmemptoris_contract_managementMatch10.0.1.3
OR
ibmemptoris_contract_managementMatch10.0.1.5
OR
ibmemptoris_contract_managementMatch10.0.2.0
OR
ibmemptoris_contract_managementMatch10.0.2.1
OR
ibmemptoris_contract_managementMatch10.0.2.2

9 High

AI Score

Confidence

High

6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

51.2%

Related for CVE-2014-3040