Cross-Site Scripting Vulnerability in IBM Emptoris Spend Analysis
CVE-2019-4482

5.4MEDIUM

Key Information:

Vendor: IBM
Status: Emptoris Spend Analysis
Vendor: CVE Published:; 20 August 2019

Summary

IBM Emptoris Spend Analysis versions 10.1.0 to 10.1.3 are susceptible to a cross-site scripting vulnerability that enables attackers to inject arbitrary JavaScript code into the web user interface. This exploitation could lead to unauthorized actions performed in the context of a trusted session, raising concerns about potential credential disclosure and manipulation of user sessions.

Affected Version(s)

Emptoris Spend Analysis 10.1.0

Emptoris Spend Analysis 10.1.3

References

https://www.ibm.com/support/docview.wss?uid=ibm10880217

x_refsource_CONFIRM

https://exchange.xforce.ibmcloud.com/vulnerabilities/164066

vdb-entryx_refsource_XF

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Aug 20, 2019
Vulnerability Reserved
Jan 3, 2019