CVEvulnerability
CVE-2014-0864
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-07-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a deal's currency or (2) a limit via a crafted XML document.
Affected configurations
• ibm algo credit limits 4.5.0
• ibm algo credit limits 4.7.0
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Jun/173 seclists.org
- http://secunia.com/advisories/59296 secunia.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21675881 Vendor Advisory
- http://www.securityfocus.com/archive/1/532598/100/0/threaded www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90938 exchange.xforce.ibmcloud.com
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt Exploit
- http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Jun/173 seclists.org
- http://secunia.com/advisories/59296 secunia.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21675881 Vendor Advisory
- http://www.securityfocus.com/archive/1/532598/100/0/threaded www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90938 exchange.xforce.ibmcloud.com
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt Exploit