CVE-2014-6092

CWE-173 documents3 sources
Severity
5.0MEDIUM
EPSS
0.5%
top 32.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Curam Social Program Management
Timeline
PublishedApr 27
Latest updateMay 17

Description

IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause a denial of service (web-service outage) by making many login attempts with a valid caseworker account name.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-m95x-wpv9-pr9r: IBM Curam Social Program Management (SPM) 5↗2022-05-17
▶
CVEList
CVE-2014-6092: IBM Curam Social Program Management (SPM) 5↗2015-04-27
▶