{"id":"CVE-2013-4061","url":"https://www.cyber-defence.io/tools/cve/CVE-2013-4061","generatedAt":"2026-10-27T19:52:46.181Z","title":"IBM Rational Policy Tester 8.5 before 8.5.0.5 does not properly check authorization for changes to the set of authentication hosts, which allows remote authenticated users to perform spoofing attacks involving an HTTP redirect via unspecified vectors.","description":"IBM Rational Policy Tester 8.5 before 8.5.0.5 does not properly check authorization for changes to the set of authentication hosts, which allows remote authenticated users to perform spoofing attacks involving an HTTP redirect via unspecified vectors.","published":"2013-09-09T01:55:06.000Z","lastModified":"2026-06-16T23:56:33.000Z","status":"Modified","sourceIdentifier":"psirt@us.ibm.com","cvss":{"version":"2.0","score":4,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N"},"cwe":["CWE-287"],"affected":["ibm/rational policy tester"],"epss":{"score":0.00884,"percentile":0.58943,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.88%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21648481","source":"psirt@us.ibm.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86585","source":"psirt@us.ibm.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21648481","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86585","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4061","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}