Cross-Site Scripting Vulnerability in IBM Emptoris Sourcing
CVE-2017-1444

5.4MEDIUM

Key Information:

Vendor: IBM
Status: Emptoris Sourcing
Vendor: CVE Published:; 31 August 2017

Summary

IBM Emptoris Sourcing versions 9.5 and 10.1.3 have a vulnerability that allows attackers to inject arbitrary JavaScript code into the web interface. This attack can manipulate the web application’s behavior and compromise user credentials during trusted sessions, heightening the risks of unauthorized access to sensitive data and functions within the application.

Affected Version(s)

Emptoris Sourcing 9.5

Emptoris Sourcing 10.0.0

Emptoris Sourcing 10.0.1

References

http://www-01.ibm.com/support/docview.wss?uid=swg22005834

x_refsource_CONFIRM

https://exchange.xforce.ibmcloud.com/vulnerabilities/128110

x_refsource_MISC

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Aug 31, 2017
Vulnerability Reserved
Nov 30, 2016