CVE-2014-4803

EUVD-2014-4722
CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
ibmcuram_social_program_management
𝑥
≤ 6.0
ibmcuram_social_program_management
6.0.4.0
ibmcuram_social_program_management
6.0.4.1
ibmcuram_social_program_management
6.0.4.2
ibmcuram_social_program_management
6.0.4.3
ibmcuram_social_program_management
6.0.4.4
ibmcuram_social_program_management
6.0.4.5
ibmcuram_social_program_management
6.0.5.0
ibmcuram_social_program_management
6.0.5.1
ibmcuram_social_program_management
6.0.5.2
ibmcuram_social_program_management
6.0.5.3
ibmcuram_social_program_management
6.0.5.4
ibmcuram_social_program_management
6.0.5.5
𝑥
= Vulnerable software versions
References
http://www-01.ibm.com/support/docview.wss?uid=swg21695925
https://exchange.xforce.ibmcloud.com/vulnerabilities/95305
http://www-01.ibm.com/support/docview.wss?uid=swg21695925
https://exchange.xforce.ibmcloud.com/vulnerabilities/95305