PT-2017-5933 · Ibm · Ibm Curam Social Program Management

Published 2017-06-08 · Updated 2017-06-15 · CVE-2014-4843

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IBM Curam Social Program Management (SPM) versions 6.0 SP2 before EP26 IBM Curam Social Program Management (SPM) versions 6.0.4 before 6.0.4.6 IBM Curam Social Program Management (SPM) versions 6.0.5 before 6.0.5.5 iFix5

Description: The issue allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.

Recommendations: For versions 6.0 SP2 before EP26, update to EP26 or later. For versions 6.0.4 before 6.0.4.6, update to 6.0.4.6 or later. For versions 6.0.5 before 6.0.5.5 iFix5, update to 6.0.5.5 iFix5 or later.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2014-4843

Affected Products

Ibm Curam Social Program Management

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-4843 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21698548 · Vendor Advisory
• http://securityfocus.com/bid/73943 · Note