PT-2015-3839 · Ibm · Ibm Emptoris Sourcing+3

Published 2015-01-10 · Updated 2017-09-08 · CVE-2014-6212

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Emptoris Contract Management versions 9.5.x through 9.5.0.5, 10.0.0.x through 10.0.0.0, 10.0.1.x through 10.0.1.4, and 10.0.2.x through 10.0.2.1 IBM Emptoris Sourcing versions 9.5 through 9.5.1.2, 10.0.0.x through 10.0.0.0, 10.0.1.x through 10.0.1.2, and 10.0.2.x through 10.0.2.4 IBM Emptoris Program Management versions 10.0.0.x through 10.0.0.2, 10.0.1.x through 10.0.1.3, and 10.0.2.x through 10.0.2.4 IBM Emptoris Strategic Supply Management versions 10.0.0.x through 10.0.0.2, 10.0.1.x through 10.0.1.3, and 10.0.2.x through 10.0.2.4

Description The issue allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This occurs in the Echo API.

Recommendations For IBM Emptoris Contract Management versions 9.5.x through 9.5.0.5, update to 9.5.0.6 iFix11 or later. For IBM Emptoris Contract Management versions 10.0.0.x through 10.0.0.0, update to 10.0.0.1 iFix12 or later. For IBM Emptoris Contract Management versions 10.0.1.x through 10.0.1.4, update to 10.0.1.5 iFix2 or later. For IBM Emptoris Contract Management versions 10.0.2.x through 10.0.2.1, update to 10.0.2.2 iFix5 or later. For IBM Emptoris Sourcing versions 9.5 through 9.5.1.2, update to 9.5.1.3 iFix2 or later. For IBM Emptoris Sourcing versions 10.0.0.x through 10.0.0.0, update to 10.0.0.1 iFix1 or later. For IBM Emptoris Sourcing versions 10.0.1.x through 10.0.1.2, update to 10.0.1.3 iFix1 or later. For IBM Emptoris Sourcing versions 10.0.2.x through 10.0.2.4, update to 10.0.2.5 or later. For IBM Emptoris Program Management versions 10.0.0.x through 10.0.0.2, update to 10.0.0.3 iFix6 or later. For IBM Emptoris Program Management versions 10.0.1.x through 10.0.1.3, update to 10.0.1.4 iFix1 or later. For IBM Emptoris Program Management versions 10.0.2.x through 10.0.2.4, update to 10.0.2.5 or later. For IBM Emptoris Strategic Supply Management versions 10.0.0.x through 10.0.0.2, update to 10.0.0.3 iFix6 or later. For IBM Emptoris Strategic Supply Management versions 10.0.1.x through 10.0.1.3, update to 10.0.1.4 iFix1 or later. For IBM Emptoris Strategic Supply Management versions 10.0.2.x through 10.0.2.4, update to 10.0.2.5 or later.

Fix

Related Identifiers

CVE-2014-6212

Affected Products

Ibm Emptoris Contract Management

Ibm Emptoris Program Management

Ibm Emptoris Sourcing

Ibm Emptoris Strategic Supply Management

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-6212 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21693069 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98689 · Note