IBM Cúram Social Program Management Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	74312
Class:	Design Error
CVE:	CVE-2014-6090
Remote:	Yes
Local:	No
Published:	Apr 21 2015 12:00AM
Updated:	Apr 21 2015 12:00AM
Credit:	IBM
Vulnerable:	IBM Cúram Social Program Management 6.0.5 IBM Cúram Social Program Management 6.0.4 IBM Cúram Social Program Management 6.0.3 IBM Cúram Social Program Management 6.0.5.5 IBM Cúram Social Program Management 6.0.5.4 IBM Cúram Social Program Management 6.0.5.3 IBM Cúram Social Program Management 6.0.5.2 IBM Cúram Social Program Management 6.0.5.1 IBM Cúram Social Program Management 6.0.4.5 IBM Cúram Social Program Management 6.0.4.4 IBM Cúram Social Program Management 6.0.4.3 IBM Cúram Social Program Management 6.0.4.2 IBM Cúram Social Program Management 6.0.4.1 IBM Cúram Social Program Management 6.0.4.0 IBM Cúram Social Program Management 6.0 SP2 EP2 IBM Cúram Social Program Management 6.0 SP2 IBM Cúram Social Program Management 5.2 SP6
Not Vulnerable:	IBM Cúram Social Program Management 6.0.5.6 IBM Cúram Social Program Management 6.0.4.5 iFix10 IBM Cúram Social Program Management 6.0.3.0 iFix8 IBM Cúram Social Program Management 6.0 SP2 EP26 IBM Cúram Social Program Management 5.2 SP6 EP6

IBM Cúram Social Program Management Multiple Cross Site Request Forgery Vulnerabilities

IBM Cúram Social Program Management is prone to multiple cross-site request-forgery vulnerabilities because it fails to properly validate HTTP requests.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

IBM Cúram Social Program Management 5.2 SP6, 6.0 SP2, 6.0.3, 6.0.4, 6.0.5 are vulnerable.

IBM Cúram Social Program Management Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.