PT-2012-2835 · Ibm · Ibm Rational Clearquest

Publicado

2012-08-17

·

Atualizado

2017-08-29

·

CVE-2012-0744

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 7.1.x through 7.1.2.7 IBM Rational ClearQuest versions 8.x through 8.0.0.3
Description The issue allows remote attackers to obtain potentially sensitive information via a request to various endpoints, including "snoop", "hello", "ivt/", "hitcount", "HitCount.jsp", "HelloHTMLError.jsp", "HelloHTML.jsp", "HelloVXMLError.jsp", "HelloVXML.jsp", "HelloWMLError.jsp", "HelloWML.jsp", or "cqweb/j security check" sample script.
Recommendations For IBM Rational ClearQuest versions 7.1.x through 7.1.2.7, update to a version outside of this range to resolve the issue. For IBM Rational ClearQuest versions 8.x through 8.0.0.3, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the mentioned endpoints to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-0744

Produtos afetados

Ibm Rational Clearquest