CVE-2015-4939

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.2%

top 53.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Emptoris Program Management IBM Emptoris Strategic Supply Management IBM Emptoris Supplier Lifecycle Management

Timeline

PublishedOct 6

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDibm/emptoris_supplier_lifecycle_management13 versions+12

▶NVDibm/emptoris_program_management16 versions+15

▶NVDibm/emptoris_strategic_supply_management17 versions+16

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-x922-fjm6-h48g: Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10↗2022-05-17

▶

CVEList

CVE-2015-4939: Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10↗2015-10-05

▶