Skip to main content

Emptoris Contract Management CVE-2019-4484

MEDIUM
Error Message Information Leak (CWE-209)
2019-08-20 psirt@us.ibm.com
IBM Information Disclosure Emptoris Contract Management Emptoris Sourcing Emptoris Spend Analysis
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 20, 2019 - 19:15 nvd
MEDIUM 4.3

DescriptionNVD

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068.

AnalysisAI

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-209. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068. Affected products include: Ibm Emptoris Contract Management, Ibm Emptoris Sourcing, Ibm Emptoris Spend Analysis. Version information: through 10.1.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Emptoris Contract Management

View all
CVE-2019-4483 CRITICAL
9.8 Aug 20

IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL
CVE-2019-4481 CRITICAL
9.8 Aug 20

IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL
CVE-2015-5050 HIGH
8.8 Feb 15

Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.
CVE-2015-5042 HIGH
7.5 Feb 15

IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x be
CVE-2014-3041 MEDIUM
6.5 Aug 26

SQL injection vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 i
CVE-2014-3040 MEDIUM
6.0 Aug 26

Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0
CVE-2015-7398 MEDIUM
5.4 Feb 15

Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and
CVE-2016-6018 MEDIUM
4.3 Jul 19

IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an a
CVE-2019-4485 MEDIUM
4.3 Aug 20

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analy
CVE-2019-4308 MEDIUM
4.3 Aug 20

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analy
CVE-2014-6212 MEDIUM
4.0 Jan 10

The Echo API in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix11, 10.0.0.x before 10.0.0.1 iFix12, 10.0.1.x

CVE-2014-3034 LOW
3.5 Aug 26

Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x befo

Same weakness CWE-209 – Error Message Information Leak

View all
CVE-2025-47813 MEDIUM POC
4.3
CVE-2017-7551 CRITICAL POC
9.8
CVE-2026-48039 CRITICAL POC
9.1
CVE-2022-31140 CRITICAL POC
9.1
CVE-2024-23689 HIGH POC
8.8
CVE-2018-17961 HIGH POC
8.6
CVE-2023-37306 HIGH POC
7.5
CVE-2026-29146 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2019-4484 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy