Information disclosure in IBM Curam Social Program Management

CVE-2014-4804

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page.

Vulnerability class: Information Disclosure

EPSS: 0.011 (61.3th percentile) — read the EPSS interpretation.

Affected products

Ibm Curam_social_program_management — versions 6.0, 6.0.4.5, 6.0.5.4
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@us.ibm.com (vdb-entry, x_refsource_XF)
psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)