CVE-2014-6090: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) Datast...

Security readout for executives and security teams

This issue affects specific older IBM Curam Social Program Management versions. A remote attacker could trick a legitimate user into sending unwanted requests that insert XSS content. Business risk depends heavily on whether the organization still runs the listed Curam releases and exposes the affected editor servlets to users. Likely exposure is limited to organizations running the affected IBM Curam SPM 5.2, 6.0, 6.0.3, 6.0.4, or 6.0.5 branches below the fixed levels. The source bundle does not confirm internet exposure, default configuration, or affected deployment roles. Treat as a targeted legacy-platform exposure check. If Curam SPM is not present, priority is low. If affected versions remain in use, prioritize remediation because the issue can combine CSRF with XSS insertion under a legitimate user's session. Mitigation focus: Check IBM advisory swg21697726 for exact remediation guidance.; Upgrade affected Curam SPM deployments to the fixed EP or iFix levels named by IBM.; Limit access to Curam administrative/editor functionality to trusted networks and users..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.