CVE-2014-3012

Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/59257
http://www-01.ibm.com/support/docview.wss?uid=swg21675454	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/93010

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:curam_social_program_management:5.2:sp1::::::
	cpe:2.3:a:ibm:curam_social_program_management:5.2:sp4::::::
	cpe:2.3:a:ibm:curam_social_program_management:6.0:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.3.0:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.0:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.1:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.2:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.3:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.4:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.4.5:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.0:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.1:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.2:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.3:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:6.0.5.4:::::::*

History

No history.

Information

Published : 2014-06-18 16:55

Updated : 2017-08-29 01:34

NVD link : CVE-2014-3012

Mitre link : CVE-2014-3012

CVE.ORG link : CVE-2014-3012

JSON object : View

Products Affected

ibm

curam_social_program_management

CWE

NVD-CWE-Other

{"id": "CVE-2014-3012", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-18T16:55:07.687", "references": [{"url": "http://secunia.com/advisories/59257", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675454", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93010", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n CRLF en IBM Curam Social Program Management 5.2 SP1 hasta 6.0.5.4 permiten a usuarios remotos autenticados inyectar cabeceras HTTP arbitrarias y realizar ataques de divisi\u00f3n de respuesta HTTP a trav\u00e9s de par\u00e1metros no especificados en custom JSPs."}], "lastModified": "2017-08-29T01:34:35.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:curam_social_program_management:5.2:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A64B23F-E318-4506-946D-F30BB453282E"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:5.2:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8634A1FB-ECD1-45A7-9186-37EB6974EDD3"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDD18D50-AEBC-4131-B89F-F2A74501E0A0"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8540059F-8E22-4684-B161-B3EC5996286E"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEFDBB0F-A8C9-40DF-81CF-799D034D2EE0"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB8E3B08-7171-414D-8A41-14C9E18B1BAB"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "940271A7-2CC3-4A34-BB5A-D9F4D45A7895"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2F3FDC1-B49D-46DD-B9F7-DCE3F1FD4B5A"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13AA664F-BCD8-4CED-A201-E2543D437E1C"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6711519-4E7D-4782-8372-7996C24E50D6"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17929DC8-0E48-4BF4-AAFE-6463C8540FF9"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FD3FF4C-C12A-4CBC-8983-85929C5D121E"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAE6D88C-92CF-415E-978C-0107C4C4C52C"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB928C52-91BB-43A6-B25F-F359F05F1388"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25DE6951-4C91-4443-843C-805D416F4074"}], "operator": "OR"}]}], "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/93.html\n\n\"CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')\"", "sourceIdentifier": "psirt@us.ibm.com"}