CVE:CVE-2015-4971
CNNVD:CNNVD-201510-036
IBM Emptoris Strategic Supply Management Platform和Emptoris Program Management都是美国IBM公司的产品。前者是一套基于Web的通用门户访问Emptoris套件产品的管理平台。后者是一套为供应商支出、采购等提供管理功能的解决方案。
IBM Emptoris Strategic Supply Management Platform 10.0.0版本至10.0.4版本和Emptoris Program Management 10.0.0版本至10.0.4版本中存在跨站脚本漏洞。远程攻击者可借助特制的URL利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade ibm emptoris to a higher version than supplier_lifecycle_management:10.0.0.0,supplier_lifecycle_management:10.0.0.1,supplier_lifecycle_management:10.0.0.2,supplier_lifecycle_management:10.0.0.3,supplier_lifecycle_management:10.0.1.0,supplier_lifecycle_management:10.0.1.1,supplier_lifecycle_management:10.0.1.2,supplier_lifecycle_management:10.0.2.0,supplier_lifecycle_management:10.0.2.2,supplier_lifecycle_management:10.0.2.3,supplier_lifecycle_management:10.0.2.5,supplier_lifecycle_management:10.0.2.6,supplier_lifecycle_management:10.0.2.7,strategic_supply_management:10.0.0.0,strategic_supply_management:10.0.0.1,strategic_supply_management:10.0.0.2,strategic_supply_management:10.0.0.3,strategic_supply_management:10.0.1.0,strategic_supply_management:10.0.1.1,strategic_supply_management:10.0.1.2,strategic_supply_management:10.0.1.3,strategic_supply_management:10.0.1.4,strategic_supply_management:10.0.2.0,strategic_supply_management:10.0.2.1,strategic_supply_management:10.0.2.2,strategic_supply_management:10.0.2.3,strategic_supply_management:10.0.2.4,strategic_supply_management:10.0.2.5,strategic_supply_management:10.0.2.6,strategic_supply_management:10.0.2.7,and avoid the version supplier_lifecycle_management:10.0.0.0,supplier_lifecycle_management:10.0.0.1,supplier_lifecycle_management:10.0.0.2,supplier_lifecycle_management:10.0.0.3,supplier_lifecycle_management:10.0.1.0,supplier_lifecycle_management:10.0.1.1,supplier_lifecycle_management:10.0.1.2,supplier_lifecycle_management:10.0.2.0,supplier_lifecycle_management:10.0.2.2,supplier_lifecycle_management:10.0.2.3,supplier_lifecycle_management:10.0.2.5,supplier_lifecycle_management:10.0.2.6,supplier_lifecycle_management:10.0.2.7,strategic_supply_management:10.0.0.0,strategic_supply_management:10.0.0.1,strategic_supply_management:10.0.0.2,strategic_supply_management:10.0.0.3,strategic_supply_management:10.0.1.0,strategic_supply_management:10.0.1.1,strategic_supply_management:10.0.1.2,strategic_supply_management:10.0.1.3,strategic_supply_management:10.0.1.4,strategic_supply_management:10.0.2.0,strategic_supply_management:10.0.2.1,strategic_supply_management:10.0.2.2,strategic_supply_management:10.0.2.3,strategic_supply_management:10.0.2.4,strategic_supply_management:10.0.2.5,strategic_supply_management:10.0.2.6,strategic_supply_management:10.0.2.7; Upgrade ibm emptoris_program_management to a higher version than 10.0.0.0,10.0.0.1,10.0.0.2,10.0.0.3,10.0.1.0,10.0.1.1,10.0.1.2,10.0.1.3,10.0.1.4,10.0.2.0,10.0.2.1,10.0.2.2,10.0.2.3,10.0.2.4,10.0.2.5,10.0.2.6,10.0.2.7,and avoid the version 10.0.0.0,10.0.0.1,10.0.0.2,10.0.0.3,10.0.1.0,10.0.1.1,10.0.1.2,10.0.1.3,10.0.1.4,10.0.2.0,10.0.2.1,10.0.2.2,10.0.2.3,10.0.2.4,10.0.2.5,10.0.2.6,10.0.2.7