CVE-2014-6090: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and 6.0.5 before 6.0.5.6 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6090?
CVE-2014-6090 is classified as a moderate severity vulnerability due to potential cross-site request forgery (CSRF) risks.
How do I fix CVE-2014-6090?
To address CVE-2014-6090, it is recommended to update IBM Curam Social Program Management to the latest patched version.
What types of vulnerabilities does CVE-2014-6090 include?
CVE-2014-6090 includes multiple cross-site request forgery (CSRF) vulnerabilities in specific IBM Curam SPM servlets.
Which versions of IBM Curam Social Program Management are affected by CVE-2014-6090?
CVE-2014-6090 affects IBM Curam Social Program Management versions 5.2 SP6, 6.0 SP2, 6.0.3 before 6.0.3.0 iFix8, and 6.0.4 before 6.0.4.5.
Is CVE-2014-6090 specific to certain IBM Curam SPM components?
Yes, CVE-2014-6090 specifically affects the DataMappingEditorCommands, DatastoreEditorCommands, and IEGEditorCommands servlets.