CVE-2014-4786

EUVD-2014-4705 · Published Sep 10, 2014

IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks, and bypass intended access restrictions or obtain sensitive information, via a crafted web site, related to a "frame injection" issue.

Technologies

Ibm Initiate Master Data Service

Weaknesses

CWE-264

CVSS scores

v2.04.9AV:N/AC:M/Au:S/C:P/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

http://secunia.com/advisories/60996
http://www-01.ibm.com/support/docview.wss?uid=swg21682450
http://www.securityfocus.com/bid/69720
https://exchange.xforce.ibmcloud.com/vulnerabilities/95033

Potentially impacted assets

See if this affects your attack surface