CVE-2020-4942 — Cross-Site Request Forgery in IBM Curam SPM

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 70.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Curam SPMIBM Curam Social Program Management
Timeline
PublishedJan 4
Latest updateMay 24

Description

IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDibm/curam_social_program_management7.0.11.0, 7.0.9.0+1
▶CVEListV5ibm/curam_spm7.0.11, 7.0.9+1

🔴Vulnerability Details

2
GHSA
GHSA-rfw8-3q2w-42qv: IBM Curam Social Program Management 7↗2022-05-24
▶
CVEList
CVE-2020-4942: IBM Curam Social Program Management 7↗2021-01-04
▶
CVE-2020-4942 — Cross-Site Request Forgery in IBM | cvebase