CVE-2014-6090: CSRF
First published: Mon Apr 27 2015(Updated: )
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and 6.0.5 before 6.0.5.6 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Curam Social Program Management | =5.2-sp6 | |
| IBM Curam Social Program Management | =6.0-sp2 | |
| IBM Curam Social Program Management | =6.0.3.0 | |
| IBM Curam Social Program Management | =6.0.4.0 | |
| IBM Curam Social Program Management | =6.0.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-6090?
CVE-2014-6090 is classified as a moderate severity vulnerability due to potential cross-site request forgery (CSRF) risks.
How do I fix CVE-2014-6090?
To address CVE-2014-6090, it is recommended to update IBM Curam Social Program Management to the latest patched version.
What types of vulnerabilities does CVE-2014-6090 include?
CVE-2014-6090 includes multiple cross-site request forgery (CSRF) vulnerabilities in specific IBM Curam SPM servlets.
Which versions of IBM Curam Social Program Management are affected by CVE-2014-6090?
CVE-2014-6090 affects IBM Curam Social Program Management versions 5.2 SP6, 6.0 SP2, 6.0.3 before 6.0.3.0 iFix8, and 6.0.4 before 6.0.4.5.
Is CVE-2014-6090 specific to certain IBM Curam SPM components?
Yes, CVE-2014-6090 specifically affects the DataMappingEditorCommands, DatastoreEditorCommands, and IEGEditorCommands servlets.
- collector/nvd-index
- agent/weakness
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/ibm
- canonical/ibm curam social program management
- version/ibm curam social program management/5.2-sp6
- version/ibm curam social program management/6.0-sp2
- version/ibm curam social program management/6.0.3.0
- version/ibm curam social program management/6.0.4.0
- version/ibm curam social program management/6.0.5.0