CVE-2014-0871 RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-pr...
MediumCVSS 4.3
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-printing characters in a cookie to the /classes/ URI, as demonstrated by the \x00 character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm algo credit limits | = 4.5.0 | No fix listed |
| ibm algo credit limits | = 4.7.0 | No fix listed |
| ibm algorithmics | All versions | No fix listed |
References
- packetstormsecurity.com
- 20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS mailing-list
- 59296 third-party-advisory
- www-01.ibm.com vendor-advisory
- 20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS mailing-list
- ibm-aclm-cve20140871-tomcat(90945) vdb-entry
- www.sec-consult.com