CVE-2014-0864

IBM Algo Credit Limits - CSRF

Title source: rule

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a deal's currency or (2) a limit via a crafted XML document.

Exploits (1)

exploitdb WRITEUP

webappsjsp

https://www.exploit-db.com/exploits/33942

View Code ZIP pw:eip

References (7)

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/532598/100/0/threaded

[Third Party Advisory] http://secunia.com/advisories/59296

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/90938

[Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg21675881

[Exploit] https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt

[Mailing List] http://seclists.org/fulldisclosure/2014/Jun/173

Scores

EPSS 0.0368

EPSS Percentile 88.0%

Details

CWE

CWE-352

Status published

Products (2)

ibm/algo_credit_limits 4.5.0

ibm/algo_credit_limits 4.7.0

Published Jul 07, 2014

Tracked Since Feb 18, 2026