Stored Cross-Site Scripting in IBM Emptoris Strategic Supply Management
CVE-2020-4895
6.4MEDIUM
Summary
IBM Emptoris Strategic Supply Management versions 10.1.0, 10.1.1, and 10.1.3 contain a stored cross-site scripting vulnerability. This flaw permits users to inject arbitrary JavaScript code into the web user interface, which can disrupt normal operations and lead to unauthorized disclosure of credentials within a session that is otherwise trusted. This type of vulnerability can significantly compromise the security of applications and data by enabling attackers to manipulate user interactions.
Affected Version(s)
Emptoris Sourcing 10.1.0
Emptoris Sourcing 10.1.1
Emptoris Sourcing 10.1.3
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved