| Vulnerability Name: | CVE-2014-0864 (CCN-90938) | ||||||||
| Assigned: | 2014-06-23 | ||||||||
| Published: | 2014-06-23 | ||||||||
| Updated: | 2018-10-09 | ||||||||
| Summary: | Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a deal's currency or (2) a limit via a crafted XML document. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-352 | ||||||||
| Vulnerability Consequences: | Cross-Site Scripting | ||||||||
| References: | Source: MITRE Type: CNA CVE-2014-0864 Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html Source: FULLDISC Type: UNKNOWN 20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS Source: SECUNIA Type: UNKNOWN 59296 Source: CONFIRM Type: Vendor Advisory http://www-01.ibm.com/support/docview.wss?uid=swg21675881 Source: CCN Type: IBM Security Bulletin 1675881 Multiple Security Vulnerabilities in Certain GUI Components of IBM Algo Credit Limits. Source: BUGTRAQ Type: UNKNOWN 20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS Source: CCN Type: BID-68262 IBM Algo Credit Limits CVE-2014-0864 Cross Site Request Forgery Vulnerability Source: XF Type: UNKNOWN ibm-algo-cve20140864-csrf(90938) Source: XF Type: UNKNOWN ibm-aclm-cve20140864-csrf(90938) Source: CCN Type: Packet Storm Security [06-30-2014] IBM Algorithmics RICOS Disclosure / XSS / CSRF Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-01-2014] Source: MISC Type: Exploit https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||