CVE-2014-0865 EXPLOIT
4.9
MEDIUM · CVSS 2.0 · EPSS 5% (pctl 92)
Patch early
A public exploit exists.
Description
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limit manipulations.
Scoring
| CVSS | 4.9 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:S/C:N/I:P/A:P |
| EPSS | 4.98% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-07-07 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| ibm | algo credit limits |
| ibm | algorithmics |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | 2014-07-01 |
References
- http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html
- http://seclists.org/fulldisclosure/2014/Jun/173
- http://secunia.com/advisories/59296
- http://www-01.ibm.com/support/docview.wss?uid=swg21675881
- http://www.securityfocus.com/archive/1/532598/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90939
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt
- http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html
- http://seclists.org/fulldisclosure/2014/Jun/173
- http://secunia.com/advisories/59296
- http://www-01.ibm.com/support/docview.wss?uid=swg21675881
- http://www.securityfocus.com/archive/1/532598/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90939
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt
→ the Explorer · watch your stack · NVD