PT-2019-17105 · Ibm · Ibm Emptoris Spend Analysis+2

Published 2019-08-20 · Updated 2022-12-02 · CVE-2019-4485

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Emptoris Sourcing versions 10.1.0 through 10.1.3 IBM Contract Management versions 10.1.0 through 10.1.3 IBM Emptoris Spend Analysis versions 10.1.0 through 10.1.3

Description The issue generates an error message that includes sensitive information, which could be used in further attacks against the system.

Recommendations For IBM Emptoris Sourcing versions 10.1.0 through 10.1.3, update to a version that does not generate sensitive error messages. For IBM Contract Management versions 10.1.0 through 10.1.3, update to a version that does not generate sensitive error messages. For IBM Emptoris Spend Analysis versions 10.1.0 through 10.1.3, update to a version that does not generate sensitive error messages.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-4485

Affected Products

Ibm Contract Management

Ibm Emptoris Sourcing

Ibm Emptoris Spend Analysis

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/164069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4485 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10880221 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4485 · Vendor Advisory