CVE-2014-0868 RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intende...
MediumCVSS 4.9
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by manipulation of read-only limit data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm algo credit limits | = 4.5.0 | No fix listed |
| ibm algo credit limits | = 4.7.0 | No fix listed |
| ibm algorithmics | All versions | No fix listed |
References
- packetstormsecurity.com
- 20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS mailing-list
- 59296 third-party-advisory
- www-01.ibm.com vendor-advisory
- 20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS mailing-list
- ibm-aclm-cve20140868-sec-bypass(90942) vdb-entry
- www.sec-consult.com