PT-2009-5985 · Ibm · Ibm Rational Requisitepro

Publicado 2009-10-20 · Atualizado 2009-10-27 · CVE-2009-3730

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational RequisitePro version 7.1.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help feature of IBM Rational RequisitePro. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in certain API endpoints. The affected endpoints include "ReqWebHelp/advanced/workingSet.jsp" where the operation parameter is vulnerable, and "ReqWebHelp/basic/searchView.jsp" where the searchWord, maxHits, scopedSearch, and scope parameters are vulnerable.

Recommendations For IBM Rational RequisitePro version 7.1.0, consider disabling the ReqWeb Help feature until a patch is available. Restrict access to the vulnerable API endpoints "ReqWebHelp/advanced/workingSet.jsp" and "ReqWebHelp/basic/searchView.jsp" to minimize the risk of exploitation. Avoid using the operation, searchWord, maxHits, scopedSearch, and scope parameters in the affected endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3730

Produtos afetados

Ibm Rational Requisitepro

Referências · 10

• 🔥 http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895 · Exploit
• 🔥 https://exploit-db.com/exploits/33293 · Exploit
• 🔥 http://securityfocus.com/bid/36721 · Exploit
• 🔥 https://exploit-db.com/exploits/33292 · Exploit
• 🔥 https://exploit-db.com/exploits/10094 · Exploit
• http://osvdb.org/59088 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3730 · Nota de Segurança
• http://vupen.com/english/advisories/2009/2958 · Aviso do Fabricante
• http://secunia.com/advisories/37052 · Aviso do Fabricante
• http://osvdb.org/59089 · Nota