PT-2014-3954 · Ibm · Ibm Sterling Selling/Fulfillment Foundation+1

Published 2014-04-21 · Updated 2017-08-29 · CVE-2014-0932

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling Order Management versions 8.5 before HF105 IBM Sterling Selling and Fulfillment Foundation versions 9.0 before HF85

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This can lead to the execution of malicious scripts on the user's browser.

Recommendations For IBM Sterling Order Management version 8.5, apply Hotfix 105 to resolve the issue. For IBM Sterling Selling and Fulfillment Foundation version 9.0, apply Hotfix 85 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-0932

Affected Products

Ibm Sterling Order Management

Ibm Sterling Selling/Fulfillment Foundation

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg21670912 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT00419 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0932 · Security Note
• http://securityfocus.com/bid/66993 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92264 · Note