IBM Emptoris Sourcing Portfolio prior 10.0.2.0 Access Restriction access control
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.2 | $0-$5k | 0.00 |
A vulnerability was found in IBM Emptoris Sourcing Portfolio. It has been declared as problematic. This vulnerability affects an unknown part of the component Access Restriction. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, and integrity. CVE summarizes:
IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 do not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks, and bypass intended access restrictions or obtain sensitive information, via a crafted web site, related to a "frame injection" issue.
The weakness was presented 08/26/2014 (Website). The advisory is available at xforce.iss.net. This vulnerability was named CVE-2014-4790 since 07/09/2014. The attack can be initiated remotely. A single authentication is necessary for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.
It is declared as highly functional.
Upgrading to version 10.0.2.0 eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at X-Force (93195). See 70744, 70742, 70737 and 70736 for similar entries.
Product
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.4VulDB Meta Temp Score: 5.2
VulDB Base Score: 5.4
VulDB Temp Score: 5.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-264
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Highly functional
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Emptoris Sourcing Portfolio 10.0.2.0
Timeline
07/09/2014 🔍08/12/2014 🔍
08/26/2014 🔍
08/26/2014 🔍
08/28/2014 🔍
03/26/2015 🔍
03/11/2018 🔍
Sources
Vendor: ibm.comAdvisory: xforce.iss.net
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-4790 (🔍)
X-Force: 93195 - IBM Emptoris Sourcing Portfolio phishing
SecurityFocus: 69363 - IBM Emptoris Sourcing Portfolio and Emptoris Spend Analysis Frame Injection Vulnerability
Secunia: 60480 - IBM Emptoris Spend Analysis Multiple Vulnerabilities, Less Critical
See also: 🔍
Entry
Created: 03/26/2015 12:07Updated: 03/11/2018 13:56
Changes: 03/26/2015 12:07 (58), 03/11/2018 13:56 (3)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.