VulnerabilityModified

CVE-2014-3040

MEDIUM 6.0EPSS 0.85%

Does this matter?

Lower severity and a low EPSS score (0.85%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before 10.0.2.2 iFix 2; Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4; and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVSS 2.0: 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS: 0.85% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: ibm/emptoris spend analysis · ibm/emptoris sourcing portfolio · ibm/emptoris contract management
Source: psirt@us.ibm.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.