CSRF in IBM Emptoris Spend Analysis
CVE-2014-3061
Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.006 (46.4th percentile) — read the EPSS interpretation.
Affected products
- Ibm Emptoris_spend_analysis — versions 9.5.0.0, 9.5.0.1, 9.5.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_SECUNIA, third-party-advisory)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)