CVE-2014-4803

2015-02-1302:59:02

[email protected]

web.nvd.nist.gov

cve-2014-4803

ibm curam

social program management

crlf injection

vulnerability

http response splitting

websphere application server

6.6 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

29.6%

JSON

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter.

Affected configurations

NVD

Node

ibmcuram_social_program_managementRange≤6.0sp2

ibmcuram_social_program_managementMatch6.0.4.0

ibmcuram_social_program_managementMatch6.0.4.1

ibmcuram_social_program_managementMatch6.0.4.2

ibmcuram_social_program_managementMatch6.0.4.3

ibmcuram_social_program_managementMatch6.0.4.4

ibmcuram_social_program_managementMatch6.0.4.5

ibmcuram_social_program_managementMatch6.0.5.0

ibmcuram_social_program_managementMatch6.0.5.1

ibmcuram_social_program_managementMatch6.0.5.2

ibmcuram_social_program_managementMatch6.0.5.3

ibmcuram_social_program_managementMatch6.0.5.4

ibmcuram_social_program_managementMatch6.0.5.5

CPENameOperatorVersion
ibm:curam_social_program_managementibm curam social program managementle6.0
ibm:curam_social_program_managementibm curam social program managementeq6.0.4.0
ibm:curam_social_program_managementibm curam social program managementeq6.0.4.1
ibm:curam_social_program_managementibm curam social program managementeq6.0.4.2
ibm:curam_social_program_managementibm curam social program managementeq6.0.4.3
ibm:curam_social_program_managementibm curam social program managementeq6.0.4.4
ibm:curam_social_program_managementibm curam social program managementeq6.0.4.5
ibm:curam_social_program_managementibm curam social program managementeq6.0.5.0
ibm:curam_social_program_managementibm curam social program managementeq6.0.5.1
ibm:curam_social_program_managementibm curam social program managementeq6.0.5.2

CPE	Name	Operator	Version
ibm:curam_social_program_management	ibm curam social program management	le	6.0
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.4.0
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.4.1
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.4.2
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.4.3
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.4.4
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.4.5
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.5.0
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.5.1
ibm:curam_social_program_management	ibm curam social program management	eq	6.0.5.2