PT-2019-17029 · Ibm · Ibm Emptoris Spend Analysis+2

Published 2019-08-20 · Updated 2023-01-31 · CVE-2019-4308

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Emptoris Sourcing versions 10.1.0 through 10.1.3 IBM Contract Management versions 10.1.0 through 10.1.3 IBM Emptoris Spend Analysis versions 10.1.0 through 10.1.3

Description The issue allows an authenticated user to obtain sensitive information from error messages.

Recommendations For IBM Emptoris Sourcing versions 10.1.0 through 10.1.3, update to a version outside of this range to resolve the issue. For IBM Contract Management versions 10.1.0 through 10.1.3, update to a version outside of this range to resolve the issue. For IBM Emptoris Spend Analysis versions 10.1.0 through 10.1.3, update to a version outside of this range to resolve the issue.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-4308

Affected Products

Ibm Contract Management

Ibm Emptoris Sourcing

Ibm Emptoris Spend Analysis

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-4308 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10880221 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/161034 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4308 · Vendor Advisory
• https://t.me/cvenotify/43243 · Telegram Post