CVE-2014-4843
Status: ModifiedMedium (5.3)—
Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Base score: 5.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.25%
- Percentile among all scored CVEs: 68
- Score date: 10/4/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-358
References
Raw JSON (NVD)
Show
{
"id": "CVE-2014-4843",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-06-08T16:29:00.183",
"references": [
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21698548",
"tags": [
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.securityfocus.com/bid/73943",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21698548",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/73943",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-358"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL."
},
{
"lang": "es",
"value": "Curam Universal Access en IBM Curam Social Program Management (SPM), versiones 6.0 SP2 anteriores a la EP26, 6.0.4 anteriores a la 6.0.4.6 y 6.0.5 anteriores a la 6.0.5.5 iFix5 permite a atacantes remotos obtener información sensible acerca de los nombres de los usuarios internos a través de vectores relacionados con la URL."
}
],
"lastModified": "2026-06-17T00:10:40.507",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C54B484-6735-460B-B8CD-CEC0A95E9E8F"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEFDBB0F-A8C9-40DF-81CF-799D034D2EE0"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB8E3B08-7171-414D-8A41-14C9E18B1BAB"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "940271A7-2CC3-4A34-BB5A-D9F4D45A7895"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2F3FDC1-B49D-46DD-B9F7-DCE3F1FD4B5A"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13AA664F-BCD8-4CED-A201-E2543D437E1C"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6711519-4E7D-4782-8372-7996C24E50D6"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17929DC8-0E48-4BF4-AAFE-6463C8540FF9"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2FD3FF4C-C12A-4CBC-8983-85929C5D121E"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAE6D88C-92CF-415E-978C-0107C4C4C52C"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB928C52-91BB-43A6-B25F-F359F05F1388"
},
{
"criteria": "cpe:2.3:a:ibm:curam_social_program_management:6.0.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25DE6951-4C91-4443-843C-805D416F4074"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@us.ibm.com"
}