CVE-2015-4971

IBM Emptoris <10.0.1.4_iFix3, <10.0.2.7_iFix1, <10.0.3.2, <10.0.4.0_iFix1 Authenticated XSS

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21966754

Scores

EPSS 0.0078
EPSS Percentile 52.2%

Details

CWE
CWE-79
Status published
Products (19)
ibm/emptoris supplier_lifecycle_management 10.0.0.0 (13 CPE variants)
ibm/emptoris strategic_supply_management 10.0.0.0 (17 CPE variants)
ibm/emptoris_program_management 10.0.0.0
ibm/emptoris_program_management 10.0.0.1
ibm/emptoris_program_management 10.0.0.2
ibm/emptoris_program_management 10.0.0.3
ibm/emptoris_program_management 10.0.1.0
ibm/emptoris_program_management 10.0.1.1
ibm/emptoris_program_management 10.0.1.2
ibm/emptoris_program_management 10.0.1.3
... and 9 more
Published Oct 06, 2015
Tracked Since Feb 18, 2026