CRITICAL
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection
Published Aug 20, 2019
9.8
CRITICALCVSS 3.1
EPSS 1.96%
Description
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164064.
Affected products
-
- Version 10.1.0StatusaffectedConstraints-
- Version 10.1.3StatusaffectedConstraints-
- Version
-
- Version 10.1.0StatusaffectedConstraints-
- Version 10.1.3StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IBM | Contract Management | n/a |
| |||||||||
| IBM | Emptoris Spend Analysis | n/a |
|
OR
- ≥ 10.1.0 · ≤ 10.1.3
- ≥ 10.1.0 · ≤ 10.1.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14088 Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/164064 vdb-entryx_refsource_XFVDB EntryVendor Advisory
- https://www.ibm.com/support/docview.wss?uid=ibm10880223 x_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14088 | Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/164064 | vdb-entryx_refsource_XFVDB EntryVendor Advisory | |
| https://www.ibm.com/support/docview.wss?uid=ibm10880223 | x_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner ibm
Published Aug 20, 2019
Updated Sep 17, 2024
Reserved Jan 3, 2019
Link CVE-2019-4481
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2019-14088 Assigner ibm
Published Aug 20, 2019
Updated Sep 17, 2024
Exploited since n/a
Link EUVD-2019-14088