CVE-2014-4804

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21695931	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95306
http://www-01.ibm.com/support/docview.wss?uid=swg21695931	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95306

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:curam_social_program_management::sp6::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0:sp2::::::
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.5:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.4:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.5:::::::*

History

No history.

Information

Published : 2015-02-14 02:59

Updated : 2025-04-12 10:46

NVD link : CVE-2014-4804

Mitre link : CVE-2014-4804

CVE.ORG link : CVE-2014-4804

JSON object : View

Products Affected

ibm

curam_social_program_management

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-4804", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-02-14T02:59:00.067", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21695931", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95306", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21695931", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95306", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page."}, {"lang": "es", "value": "Curam Universal Access en IBM Curam Social Program Management 5.2 anterior a SP6 EP6, 6.0 SP2 anterior a EP26, 6.0.4.5 anterior a iFix007, 6.0.5.4 anterior a iFix005, y 6.0.5.5 anterior a iFix003, cuando la inclusi\u00f3n SPI est\u00e1 habilitada, permite a atacantes remotos obtener datos sensibles de usuarios mediante la visita a una p\u00e1gina no especificada."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:curam_social_program_management:*:sp6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6161F2A6-3D0B-45E2-B945-C4E6D11AC1FF", "versionEndIncluding": "5.2"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C54B484-6735-460B-B8CD-CEC0A95E9E8F"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6711519-4E7D-4782-8372-7996C24E50D6"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25DE6951-4C91-4443-843C-805D416F4074"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23EA1C1F-003F-4411-AC1D-F75811D6FFEC"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}