IBM Emptoris Sourcing up to 10.1.3 redirect

Summaryinfo

A vulnerability classified as problematic was found in IBM Emptoris Sourcing up to 10.1.3. The impacted element is an unknown function. Executing a manipulation can lead to redirect. This vulnerability is handled as CVE-2017-1450. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in IBM Emptoris Sourcing up to 10.1.3. It has been declared as problematic. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect confidentiality. CVE summarizes:

IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128177.

The bug was discovered 07/11/2017. The weakness was released 08/31/2017 (Website). The advisory is shared for download at www-01.ibm.com. This vulnerability was named CVE-2017-1450 since 11/30/2016. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/10/2021). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1204.001.

The vulnerability was handled as a non-public zero-day exploit for at least 51 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-106033, VDB-106034 and VDB-106035. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• Emptoris Sourcing

Version

• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion