IBM Curam Social Program Management CVE-2014-4803 CRLF Injection Vulnerability

Bugtraq ID:	72866
Class:	Input Validation Error
CVE:	CVE-2014-4803
Remote:	Yes
Local:	No
Published:	Feb 24 2015 12:00AM
Updated:	Feb 24 2015 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Curam Social Program Management 6.0 IBM Curam Social Program Management 6.0.5.0 IBM Curam Social Program Management 6.0.4.0 IBM Curam Social Program Management 6.0 SP2
Not Vulnerable:

IBM Curam Social Program Management CVE-2014-4803 CRLF Injection Vulnerability

IBM Curam Social Program Management is prone to a CRLF-injection vulnerability.

An attacker can exploit this issue to add arbitrary headers to a webpage. This may aid in further attacks.

Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 are vulnerable.

IBM Curam Social Program Management CVE-2014-4803 CRLF Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Curam Social Program Management CVE-2014-4803 CRLF Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Curam Social Program Management CVE-2014-4803 CRLF Injection Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: IBM Cúram Universal Access is vulnerable to CRLF Injection at (IBM)