CVE-2017-1442

High

Published: 30/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

IBM Emptoris Services Procurement version 10.0.0.5 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.

Risk Assessment

An attacker could exploit this vulnerability to take control of a user's account and perform unauthorized operations, potentially leading to serious data security implications.

Recommendation

It is recommended to upgrade to the latest version of the software to mitigate the risk associated with this vulnerability and to implement additional security mechanisms against CSRF attacks.

Other vulnerabilities in IBM Emptoris Services Procurement 10.0.0.5

CVE-2017-1440High
IBM Emptoris Services Procurement version 10.0.0.5 could allow a remote attacker to include arbitrary files. An attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server.

Original NVD description (English source)

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS