PT-2014-7027 · Ibm · Ibm Security Access Manager For Web+1

Published 2014-12-18 · Updated 2017-09-08 · CVE-2014-6077

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Mobile versions 8.0.0 through 8.0.0 IBM Security Access Manager for Web versions 7.0.0 through 7.0.0 FP9 IBM Security Access Manager for Web versions 8.0.0 through 8.0.0

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Recommendations For IBM Security Access Manager for Mobile version 8.0.0, update to version 8.0.1. For IBM Security Access Manager for Web versions 7.0.0 through 7.0.0 FP9, update to version 7.0.0 FP10. For IBM Security Access Manager for Web version 8.0.0, update to version 8.0.1.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-6077

Affected Products

Ibm Security Access Manager For Mobile

Ibm Security Access Manager For Web

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6077 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21684475 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95730 · Note