Stored Cross-Site Scripting in IBM Emptoris Strategic Supply Management
CVE-2020-4895

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Emptoris Sourcing
Vendor
CVE Published:
7 January 2021

What is CVE-2020-4895?

IBM Emptoris Strategic Supply Management versions 10.1.0, 10.1.1, and 10.1.3 contain a stored cross-site scripting vulnerability. This flaw permits users to inject arbitrary JavaScript code into the web user interface, which can disrupt normal operations and lead to unauthorized disclosure of credentials within a session that is otherwise trusted. This type of vulnerability can significantly compromise the security of applications and data by enabling attackers to manipulate user interactions.

Affected Version(s)

Emptoris Sourcing 10.1.0

Emptoris Sourcing 10.1.1

Emptoris Sourcing 10.1.3

References

https://www.ibm.com/support/pages/node/6398286
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/190986
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.