Vulnerability CVE-2014-8903

Vulnerability Name:

CVE-2014-8903

Assigned:

2014-11-14

Published:

2017-08-02

Updated:

2017-08-14

Summary:

IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-77

References:

Source: MITRE
Type: CNA
CVE-2014-8903

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21700098

Source: BID
Type: Third Party Advisory, VDB Entry
73947

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:curam_social_program_management:6.0:sp2:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:curam_social_program_management:6.0.4.8:*:*:*:*:*:*:*