CVE-2019-4484 — Information Exposure via Error Message in IBM Emptoris Contract Management

CWE-209 — Information Exposure via Error Message3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 63.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
IBM Emptoris Contract ManagementIBM Emptoris SourcingIBM Emptoris Spend Analysis+1 more
Timeline
PublishedAug 20
Latest updateMay 24

Description

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages6 packages

▶NVDibm/emptoris_spend_analysis10.1.0 — 10.1.3
▶NVDibm/emptoris_contract_management10.1.0 — 10.1.3
▶CVEListV5ibm/emptoris_spend_analysis10.1.0, 10.1.3+1
▶NVDibm/emptoris_sourcing10.1.0 — 10.1.3
▶CVEListV5ibm/emptoris_sourcing10.1.0, 10.1.3+1

🔴Vulnerability Details

2
GHSA
GHSA-8jq2-g55w-rvq3: IBM Emptoris Sourcing 10↗2022-05-24
▶
CVEList
CVE-2019-4484: IBM Emptoris Sourcing 10↗2019-08-20
▶
CVE-2019-4484 — Information Exposure via Error Message | cvebase