{"api_version":"1","generated_at":"2026-07-23T07:32:07+00:00","cve":"CVE-2014-4803","urls":{"html":"https://cve.report/CVE-2014-4803","api":"https://cve.report/api/cve/CVE-2014-4803.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-4803","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-4803"},"summary":{"title":"CVE-2014-4803","description":"CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter.","state":"PUBLISHED","assigner":"ibm","published_at":"2015-02-13 02:59:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"3.5","severity":"","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95305","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95305","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21695925","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21695925","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Bulletin: IBM Cúram Universal Access is vulnerable to CRLF Injection attack when not deployed on IBM WebSphere. (CVE-2014-4803)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4803","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4803","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.4.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.4.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"6.0.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"4803","vulnerable":"1","versionEndIncluding":"6.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"curam_social_program_management","cpe6":"*","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T11:27:36.772Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"ibm-curam-cve20144803-crlf(95305)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95305"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21695925"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-02-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"ibm-curam-cve20144803-crlf(95305)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95305"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21695925"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2014-4803","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ibm-curam-cve20144803-crlf(95305)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95305"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21695925","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21695925"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2014-4803","datePublished":"2015-02-13T02:00:00.000Z","dateReserved":"2014-07-09T00:00:00.000Z","dateUpdated":"2024-08-06T11:27:36.772Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-02-13 02:59:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:*:sp2:*:*:*:*:*:*","versionEndIncluding":"6.0","matchCriteriaId":"C2530A07-5606-47F9-A469-111974655233"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.4.0:*:*:*:*:*:*:*","matchCriteriaId":"AEFDBB0F-A8C9-40DF-81CF-799D034D2EE0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.4.1:*:*:*:*:*:*:*","matchCriteriaId":"BB8E3B08-7171-414D-8A41-14C9E18B1BAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.4.2:*:*:*:*:*:*:*","matchCriteriaId":"940271A7-2CC3-4A34-BB5A-D9F4D45A7895"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.4.3:*:*:*:*:*:*:*","matchCriteriaId":"A2F3FDC1-B49D-46DD-B9F7-DCE3F1FD4B5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.4.4:*:*:*:*:*:*:*","matchCriteriaId":"13AA664F-BCD8-4CED-A201-E2543D437E1C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.4.5:*:*:*:*:*:*:*","matchCriteriaId":"A6711519-4E7D-4782-8372-7996C24E50D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.5.0:*:*:*:*:*:*:*","matchCriteriaId":"17929DC8-0E48-4BF4-AAFE-6463C8540FF9"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.5.1:*:*:*:*:*:*:*","matchCriteriaId":"2FD3FF4C-C12A-4CBC-8983-85929C5D121E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.5.2:*:*:*:*:*:*:*","matchCriteriaId":"DAE6D88C-92CF-415E-978C-0107C4C4C52C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.5.3:*:*:*:*:*:*:*","matchCriteriaId":"CB928C52-91BB-43A6-B25F-F359F05F1388"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.5.4:*:*:*:*:*:*:*","matchCriteriaId":"25DE6951-4C91-4443-843C-805D416F4074"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:curam_social_program_management:6.0.5.5:*:*:*:*:*:*:*","matchCriteriaId":"23EA1C1F-003F-4411-AC1D-F75811D6FFEC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"4803","Ordinal":"1","Title":"CVE-2014-4803","CVE":"CVE-2014-4803","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"4803","Ordinal":"1","NoteData":"CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter.","Type":"Description","Title":"CVE-2014-4803"},{"CveYear":"2014","CveId":"4803","Ordinal":"2","NoteData":"2015-02-12","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"4803","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}