PT-2017-6299 · Ibm · Ibm Curam Social Program Management

Published 2017-08-02 · Updated 2017-08-14 · CVE-2014-8903

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0 SP2 before EP26 IBM Curam Social Program Management versions 6.0.4 before 6.0.4.5iFix10 IBM Curam Social Program Management versions 6.0.5 before 6.0.5.6

Description The issue allows remote authenticated users to load arbitrary Java classes via unspecified vectors.

Recommendations For IBM Curam Social Program Management versions 6.0 SP2 before EP26, update to EP26 or later. For IBM Curam Social Program Management versions 6.0.4 before 6.0.4.5iFix10, update to 6.0.4.5iFix10 or later. For IBM Curam Social Program Management versions 6.0.5 before 6.0.5.6, update to 6.0.5.6 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2014-8903

Affected Products

Ibm Curam Social Program Management

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21700098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8903 · Security Note
• http://securityfocus.com/bid/73947 · Note