CVE-2014-8894

Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

CVSS v2.0 4.9 MEDIUM

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:N

Exploitability : 6.8 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/62674
http://www-01.ibm.com/support/docview.wss?uid=swg21694772	Patch Vendor Advisory
http://www.securityfocus.com/bid/72408
https://exchange.xforce.ibmcloud.com/vulnerabilities/99013
http://secunia.com/advisories/62674
http://www-01.ibm.com/support/docview.wss?uid=swg21694772	Patch Vendor Advisory
http://www.securityfocus.com/bid/72408
https://exchange.xforce.ibmcloud.com/vulnerabilities/99013

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:tririga_application_platform:3.2.1:::::::*
	cpe:2.3:a:ibm:tririga_application_platform:3.3.2.0:::::::*
	cpe:2.3:a:ibm:tririga_application_platform:3.3.2.1:::::::*
	cpe:2.3:a:ibm:tririga_application_platform:3.3.2.2:::::::*
	cpe:2.3:a:ibm:tririga_application_platform:3.4.0.0:::::::*
	cpe:2.3:a:ibm:tririga_application_platform:3.4.0.1:::::::*
	cpe:2.3:a:ibm:tririga_application_platform:3.4.1.0:::::::*

History

21 Nov 2024, 02:19

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/62674 -~~	() http://secunia.com/advisories/62674 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21694772 - Patch, Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21694772 - Patch, Vendor Advisory
References	~~() http://www.securityfocus.com/bid/72408 -~~	() http://www.securityfocus.com/bid/72408 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/99013 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/99013 -

Information

Published : 2015-01-29 01:59

Updated : 2024-11-21 02:19

NVD link : CVE-2014-8894

Mitre link : CVE-2014-8894

CVE.ORG link : CVE-2014-8894

JSON object : View

Products Affected

ibm

tririga_application_platform

CWE

NVD-CWE-Other

{"id": "CVE-2014-8894", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-01-29T01:59:01.450", "references": [{"url": "http://secunia.com/advisories/62674", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21694772", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/72408", "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99013", "source": "psirt@us.ibm.com"}, {"url": "http://secunia.com/advisories/62674", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21694772", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/72408", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99013", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter."}, {"lang": "es", "value": "Vulnerabilidad de redirecci\u00f3n abierta en IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 anterior a 3.3.2.3, y 3.4.1 anterior a 3.4.1.1 permite a usuarios remotos autenticados redirigir usuarios redirigir usuarios a sitios web arbitrarios y realizar ataques de phishing a trav\u00e9s del par\u00e1metro out."}], "lastModified": "2024-11-21T02:19:54.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46D0A920-F5D2-4FB7-8EF1-E892B27F3158"}, {"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "110B75DA-3B5D-4B2A-A243-C02F04A69DD8"}, {"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CFF6D9D-633A-414B-9A81-9627F1006F99"}, {"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.3.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97EB5F4E-24BB-4F17-80B1-963DBC66E44D"}, {"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC985F26-E915-49CA-951A-7E3FE59E5377"}, {"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4271E1DA-B047-4C91-93D6-EF5A9EE9AC51"}, {"criteria": "cpe:2.3:a:ibm:tririga_application_platform:3.4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27D8FE59-90C3-4EE3-BA70-01C71DCC27B0"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/601.html\">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>", "sourceIdentifier": "psirt@us.ibm.com"}