CVE-2019-4035

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X-Force ID: 156001.

IBM Content Navigator 3.0CD podría permitir que los atacantes dirijan el tráfico web a un sitio malicioso. Si los atacantes hacen un sitio IBM Content Navigator falso, pueden enviar un enlace a los usuarios ICN para enviar una petición directamente a su cliente Edit. Así, el cliente Edit descargará documentos del sitio web ICN falso. IBM X-Force ID: 156001.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-01-03 CVE Reserved
2019-03-22 CVE Published
2024-09-16 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/107557	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.ibm.com/support/docview.wss?uid=ibm10869060	2022-01-01
https://exchange.xforce.ibmcloud.com/vulnerabilities/156001	2022-01-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ibm Search vendor "Ibm"		Content Navigator Search vendor "Ibm" for product "Content Navigator"				3.0.0 Search vendor "Ibm" for product "Content Navigator" and version "3.0.0"		continuous_delivery		Affected