CVE-2019-4485: IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an…

PriorityP418medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.99%

62.4th percentile

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
ibm	contract_management	—	—
ibm	contract_management	—	—
ibm	emptoris_contract_management	10.1.0 – 10.1.3	—
ibm	emptoris_sourcing	—	—
ibm	emptoris_sourcing	—	—
ibm	emptoris_sourcing	10.1.0 – 10.1.3	—
ibm	emptoris_spend_analysis	—	—
ibm	emptoris_spend_analysis	—	—
ibm	emptoris_spend_analysis	10.1.0 – 10.1.3	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.