PT-2015-3778 · Ibm · Ibm Curam Social Program Management

Publicado 2015-02-13 · Atualizado 2017-08-29 · CVE-2014-4803

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0 SP2 through 6.0 SP2 before EP26 IBM Curam Social Program Management version 6.0.4 through 6.0.4 before 6.0.4.5 iFix007 IBM Curam Social Program Management version 6.0.5 through 6.0.5 before 6.0.5.5 iFix003

Description The issue is related to a CRLF injection vulnerability in the Universal Access implementation. This vulnerability allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter.

Recommendations For IBM Curam Social Program Management versions 6.0 SP2 through 6.0 SP2 before EP26, update to at least EP26. For IBM Curam Social Program Management version 6.0.4 through 6.0.4 before 6.0.4.5 iFix007, update to at least 6.0.4.5 iFix007. For IBM Curam Social Program Management version 6.0.5 through 6.0.5 before 6.0.5.5 iFix003, update to at least 6.0.5.5 iFix003.

Correção

Identificadores relacionados

CVE-2014-4803

Produtos afetados

Ibm Curam Social Program Management

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-4803 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95305 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21695925 · Aviso do Fabricante