IBM SPSS Collaboration and Deployment Services CVE-2013-4046 Open Redirection Vulnerability

Bugtraq ID:	64392
Class:	Input Validation Error
CVE:	CVE-2013-4046
Remote:	Yes
Local:	No
Published:	Dec 16 2013 12:00AM
Updated:	Dec 16 2013 12:00AM
Credit:	IBM
Vulnerable:	IBM SPSS Collaboration and Deployment Services 4.2.1 IBM SPSS Collaboration and Deployment Services 5.0.0
Not Vulnerable:

IBM SPSS Collaboration and Deployment Services CVE-2013-4046 Open Redirection Vulnerability

IBM SPSS Collaboration and Deployment Services is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0.0 are affected.

IBM SPSS Collaboration and Deployment Services CVE-2013-4046 Open Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

IBM SPSS Collaboration and Deployment Services CVE-2013-4046 Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM SPSS Collaboration and Deployment Services CVE-2013-4046 Open Redirection Vulnerability

References:

• IBM Homepage (IBM)
  
• SPSS Collaboration and Deployment Services Homepage (IBM)
  
• Security Bulletin: Multiple vulnerabilities in IBM SPSS Collaboration and Deploy (IBM)