CVE-2018-1961 Information disclosure in Emptoris Contract Management

What is CVE-2018-1961?

CVE-2018-1961 is a medium-severity vulnerability in IBM Emptoris Contract Management, published on 29 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657.

Weakness: CWE-200

Which versions are affected by CVE-2018-1961?

It affects 1 product.

Products include Ibm Emptoris Contract Management.

How do I fix CVE-2018-1961?

No fix has been published for CVE-2018-1961 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1961 being exploited?

There is no known exploitation of CVE-2018-1961 in the wild and no public exploit code.

Other vulnerabilities in IBM Emptoris Contract Management

• CVE-2015-5050 Cross-site request forgery in n/a High 8.8
• CVE-2019-4481 SQL injection in Contract Management High 7.6
• CVE-2019-4483 SQL injection in Contract Management High 7.6
• CVE-2015-5042 File upload in n/a High 7.5
• CVE-2014-3041 SQL injection in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j34w-447c-w9jw.