..........MMMMMMMM. ..... . .. ........7MMMMMMMMMM . .......... . ... ........OMMMMMMMMMM..................... ........8MMNMMMMMMMMMMMMMN.............. ........NMMMMMMMMMMMMMNNNND............. ....,DNMMMMMMMMMMMMMMMNDDD.............. ...DNNNNDMMMMMMMMMMMMMMNI............... ...D8DDNN7MNNMMMMMMMMMMM................ .....D8DN8NMMMMMMMMMMMMMMI.............. ........8MMMNMMMMMMMMMMMMMM............. ...........MMMMMMMMMMMMMMMMMMM.......... ........MMMMMMMMMMMMMMMMMMMMMMMM........ .......MMMMMMMMMMMMMMMMMMMMMMMMMM....... ......MMMMMMMMMMMMMMMMMMMMMMMMMMMM,..... .....MMMMMMMMMMMMMMMMMMMMMMMMMMMMM,..... .....MMMMMMMMMMMMMMMMMMMMMMMMMMMMMM..... ....MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM..... ....MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM .... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMNMMM. ... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM:.... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMD.... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN.... ________________________________________________________________________ Vendor: IBM / http://www.ibm.com Affected Products: Rational ClearQuest Web / Version 7.0.0.0 Vulnerability: Cross Site Scripting Risk: HIGH ________________________________________________________________________ Vendor communication: None. ________________________________________________________________________ Overview: Rational ClearQuest provides flexible workflow management, defect and change tracking across the application life cycle for better insight, predictability and control. Description: The flaw was found while logging a defect for another application, only to find out Cq was also vulnerable. Whilst logging a defect, upload a txt file as an attachment to the defect. Put whatever <script></script> you wish into the txt file and it will execute when another user tries to open the attachment. This could lead to session details (cqwebsession, JSESSIONID etc) being disclosed to a third party and used to hijack the users session. Finally, the Cross Site Scripting vulnerability also affects the summary page, which is PHProjekt's index page. ________________________________________________________________________ Credit: Flaw found by James Clarke / clark0r / 15.03.2007 http://www.clarkee.co.uk ________________________________________________________________________