{"api_version":"1","generated_at":"2026-07-23T12:24:49+00:00","cve":"CVE-2019-4308","urls":{"html":"https://cve.report/CVE-2019-4308","api":"https://cve.report/api/cve/CVE-2019-4308.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-4308","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-4308"},"summary":{"title":"CVE-2019-4308","description":"IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2019-08-20 19:15:00","updated_at":"2023-01-31 21:18:00"},"problem_types":["CWE-209"],"metrics":[],"references":[{"url":"https://www.ibm.com/support/docview.wss?uid=ibm10880221","name":"https://www.ibm.com/support/docview.wss?uid=ibm10880221","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Security Bulletin: Error Message Vulnerabilities Affect IBM Emptoris Sourcing, IBM Emptoris Contract Management and IBM Emptoris Spend Analysis.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/161034","name":"ibm-emptoris-cve20194308-info-disc (161034)","refsource":"XF","tags":["VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-4308","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-4308","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"4308","vulnerable":"1","versionEndIncluding":"10.1.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"emptoris_contract_management","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"4308","vulnerable":"1","versionEndIncluding":"10.1.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"emptoris_sourcing","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"4308","vulnerable":"1","versionEndIncluding":"10.1.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"emptoris_spend_analysis","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"impact":{"cvssv3":{"BM":{"AV":"N","S":"U","PR":"L","I":"N","UI":"N","SCORE":"4.300","A":"N","C":"L","AC":"L"},"TM":{"E":"U","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"data_type":"CVE","data_format":"MITRE","affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Emptoris Sourcing","version":{"version_data":[{"version_value":"10.1.0"},{"version_value":"10.1.3"}]}},{"product_name":"Contract Management","version":{"version_data":[{"version_value":"10.1.0"},{"version_value":"10.1.3"}]}},{"version":{"version_data":[{"version_value":"10.1.0"},{"version_value":"10.1.3"}]},"product_name":"Emptoris Spend Analysis"}]},"vendor_name":"IBM"}]}},"description":{"description_data":[{"lang":"eng","value":"IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034."}]},"CVE_data_meta":{"STATE":"PUBLIC","ID":"CVE-2019-4308","ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2019-08-13T00:00:00"},"references":{"reference_data":[{"title":"IBM Security Bulletin 880221 (Emptoris Sourcing)","refsource":"CONFIRM","url":"https://www.ibm.com/support/docview.wss?uid=ibm10880221","name":"https://www.ibm.com/support/docview.wss?uid=ibm10880221"},{"name":"ibm-emptoris-cve20194308-info-disc (161034)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/161034","title":"X-Force Vulnerability Report"}]},"data_version":"4.0"},"nvd":{"publishedDate":"2019-08-20 19:15:00","lastModifiedDate":"2023-01-31 21:18:00","problem_types":["CWE-209"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:emptoris_sourcing:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.0","versionEndIncluding":"10.1.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:emptoris_spend_analysis:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.0","versionEndIncluding":"10.1.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:emptoris_contract_management:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.0","versionEndIncluding":"10.1.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"4308","Ordinal":"141919","Title":"CVE-2019-4308","CVE":"CVE-2019-4308","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"4308","Ordinal":"1","NoteData":"IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"4308","Ordinal":"2","NoteData":"2019-08-20","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"4308","Ordinal":"3","NoteData":"2019-08-20","Type":"Other","Title":"Modified"}]}}}