Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

IBM Initiate Master Data Service may expose login credentials

CVE-2014-4788 · published 12 years ago
Summary

Versions of IBM Initiate Master Data Service up to 9.5.093013, 9.7.093013, 10.0.093013 and 10.1.093013 do not turn off browser autocomplete on login fields. This can allow someone with physical access to an unattended computer to retrieve stored credentials and log in remotely. Update to the latest release or configure the login pages to disable autocomplete to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm initiate_master_data_service 9.5
9.7
10.0
10.1
cpe:2.3:a:ibm:initiate_master_data_service:9.5:*:*:*:*:*:*:*
Original advisory text
IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not have an off autocomplete attribute for authentication fi...
IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-255Credentials Management Errors
Timeline
Published10 Sep 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-4788 · NVD
Track software like this
Free during beta