PT-2008-1454 · Ibm · Ibm Rational Clearquest

Publicado

2008-03-20

·

Atualizado

2018-10-15

·

CVE-2007-4592

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions prior to 2003.06.16 Patch 2008A IBM Rational ClearQuest versions 7.0.0 through 7.0.0.2 iFix01 IBM Rational ClearQuest versions 7.0.1 through 7.0.1.1 iFix01
Description The issue allows remote attackers to inject arbitrary web script or HTML via the contextid, username, userNameVal, and schema parameters to the "login component" API endpoint.
Recommendations For IBM Rational ClearQuest versions prior to 2003.06.16 Patch 2008A, apply Patch 2008A. For IBM Rational ClearQuest versions 7.0.0 through 7.0.0.2 iFix01, apply 7.0.0.2 iFix01. For IBM Rational ClearQuest versions 7.0.1 through 7.0.1.1 iFix01, apply 7.0.1.1 iFix01. As a temporary workaround, consider restricting access to the login component to minimize the risk of exploitation.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-4592

Produtos afetados

Ibm Rational Clearquest