Vulnerability Details : CVE-2013-2994
IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.
Vulnerability category: Input validation
Exploit prediction scoring system (EPSS) score for CVE-2013-2994
Probability of exploitation activity in the next 30 days: 0.29%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 65 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-2994
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST |
CWE ids for CVE-2013-2994
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-2994
-
http://www-01.ibm.com/support/docview.wss?uid=swg21644393
IBM Security Bulletin: Vulnerability in WebSphere Commerce REST services (CVE-2013-2994)Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420
IBM notice: The page you requested cannot be displayed
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/84033
IBM WebSphere Commerce REST services session hijacking CVE-2013-2994 Vulnerability Report
Products affected by CVE-2013-2994
- cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack4:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack5:*:*:*:*:*:*