{"id":"CVE-2014-4843","aliases":["EUVD-2014-4762","GHSA-5952-327w-4pc5"],"status":"published","title":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4...","description":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01253,"percentile":0.69629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-358"],"published":"2017-06-08T16:00:00Z","modified":"2026-06-17T00:10:40Z","products":[{"vendor":"ibm","product":"curam_social_program_management"}],"references":[{"url":"http://www.securityfocus.com/bid/73943","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21698548","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4843"},{"url":"https://github.com/advisories/GHSA-5952-327w-4pc5"}],"sources":{"cve":[{"id":"CVE-2014-4843","description":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.","status":"published","published":"2017-06-08T16:00:00Z","modified":"2024-08-06T11:27:36.894Z","updated_at":"2026-11-02T14:33:45.604635Z"}],"euvd":[{"id":"EUVD-2014-4762","description":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.","status":"published","published":"2017-06-08T16:00:00Z","modified":"2024-08-06T11:27:36Z","updated_at":"2026-11-03T01:57:05.209854Z"}],"ghsa":[{"id":"GHSA-5952-327w-4pc5","title":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4...","description":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.","status":"published","published":"2022-05-17T02:41:09Z","modified":"2023-01-27T05:05:40Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:42:44.481749Z"}],"nvd":[{"id":"CVE-2014-4843","description":"Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.","status":"published","published":"2017-06-08T16:29:00.183Z","modified":"2026-06-17T00:10:40.507Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:02:59.001778Z"}]}}