PT-2014-5034 · Ibm · Ibm Emptoris Spend Analysis

Published 2014-08-26 · Updated 2017-08-29 · CVE-2014-3035

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Emptoris Spend Analysis versions 9.5.x through 9.5.0.3 IBM Emptoris Spend Analysis versions 10.0.1.x through 10.0.1.2 IBM Emptoris Spend Analysis versions 10.0.2.x through 10.0.2.3

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This can lead to the execution of malicious code on the user's browser.

Recommendations For IBM Emptoris Spend Analysis versions 9.5.x through 9.5.0.3, update to version 9.5.0.4 or later. For IBM Emptoris Spend Analysis versions 10.0.1.x through 10.0.1.2, update to version 10.0.1.3 or later. For IBM Emptoris Spend Analysis versions 10.0.2.x through 10.0.2.3, update to version 10.0.2.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3035

Affected Products

Ibm Emptoris Spend Analysis

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3035 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21681277 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93194 · Note
• http://secunia.com/advisories/60480 · Note