CVE-2014-4778

2015-05-2514:59:02

CWE-20

[email protected]

web.nvd.nist.gov

cve-2014-4778

ibm

license metric tool

endpoint manager

software use analysis

clickjacking

vulnerability

6.7 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

52.3%

JSON

IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element.

Affected configurations

NVD

Node

ibmendpoint_manager_familyMatch9.0.1

ibmendpoint_manager_familyMatch9.1.0

ibmlicense_metric_toolMatch9.0

ibmlicense_metric_toolMatch9.0.1

ibmlicense_metric_toolMatch9.1.0.1

CPENameOperatorVersion
ibm:endpoint_manager_familyibm endpoint manager familyeq9.0.1
ibm:endpoint_manager_familyibm endpoint manager familyeq9.1.0
ibm:license_metric_toolibm license metric tooleq9.0
ibm:license_metric_toolibm license metric tooleq9.0.1
ibm:license_metric_toolibm license metric tooleq9.1.0.1

CPE	Name	Operator	Version
ibm:endpoint_manager_family	ibm endpoint manager family	eq	9.0.1
ibm:endpoint_manager_family	ibm endpoint manager family	eq	9.1.0
ibm:license_metric_tool	ibm license metric tool	eq	9.0
ibm:license_metric_tool	ibm license metric tool	eq	9.0.1
ibm:license_metric_tool	ibm license metric tool	eq	9.1.0.1