Vulnerability CVE-2018-1952


Published: 2019-03-14

Description:
IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153495.

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

Vendor: IBM
Product: Rational team concert 
Version:
6.0.6
6.0.5
6.0.4
6.0.3
6.0.1
6.0.0
6.0
5.0.2
5.0.1
5.0.0
5.0
Product: Rational engineering lifecycle manager 
Version:
6.0.6
6.0.3
6.0.2
6.0.1
6.0.0
6.0
5.0.2
5.0.1
5.0.0
5.0
Product: Rational doors next generation 
Version:
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
5.0.2
5.0.1
5.0.0
5.0
Product: Rational quality manager 
Version:
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
6.0
5.0.2
5.0.1
5.0.0
5.0
Product: Rational rhapsody design manager 
Version:
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
6.0
5.0.2
5.0.1
5.0.0
5.0
Product: Rational collaborative lifecycle management 
Version:
6.0.6
6.0.5
6.0.4
6.0.3
6.0.1
6.0.0
6.0
5.0.2
5.0.1
5.0.0
5.0
Product: Rational software architect design manager 
Version:
6.0.1
6.0.0
6.0
5.0.2
5.0.1
5.0.0
5.0

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
http://www.ibm.com/support/docview.wss?uid=ibm10875340
http://www.securityfocus.com/bid/107435
https://exchange.xforce.ibmcloud.com/vulnerabilities/153495

Related CVE
CVE-2019-4211
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a truste...
CVE-2019-4054
IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further attacks against the system. IBM X-Force ID: 156563.
CVE-2018-2022
IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 155346.
CVE-2018-2021
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a truste...
CVE-2019-4263
IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.
CVE-2019-4193
IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-force...
CVE-2019-4131
IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application to perform server-side DNS lookups of arbitrary domain names. IBM X-Force ID: 158270.
CVE-2019-4118
IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive information upon deployment. IBM X-Force ID: 158144.

Copyright 2019, cxsecurity.com

 

Back to Top