CVE-2014-0944: CSRF
Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0944?
CVE-2014-0944 is classified as a medium severity vulnerability due to its potential to allow authenticated users to hijack other users' authentication.
How do I fix CVE-2014-0944?
To fix CVE-2014-0944, upgrade IBM Operational Decision Manager to version 7.5 FP3 IF37 or higher, 8.0 MP1 FP2 or higher, or 8.5 MP1 IF26 or higher.
Who is affected by CVE-2014-0944?
CVE-2014-0944 affects users of IBM Operational Decision Manager versions 7.5, 8.0, and 8.5 prior to their respective patch levels.
What types of attacks can CVE-2014-0944 be exploited for?
CVE-2014-0944 can be exploited for cross-site request forgery (CSRF) attacks, allowing unauthorized actions on behalf of authenticated users.
Is user authentication compromised by CVE-2014-0944?
Yes, CVE-2014-0944 compromises user authentication by enabling remote authenticated users to hijack the sessions of arbitrary users.