PT-2014-5036 · Ibm · Ibm Rational Software Architect Design Manager+3
Publicado
2014-09-10
·
Atualizado
2017-08-29
·
CVE-2014-3037
CVSS v2.0
6.0
Média
| Vetor | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
IBM Configuration Management Application (aka VVC) versions prior to 4.0.7 and 5.x prior to 5.0.1
IBM Rational Engineering Lifecycle Manager versions prior to 4.0.7 and 5.x prior to 5.0.1
IBM Rational Software Architect Design Manager versions prior to 4.0.7 and 5.x prior to 5.0.1
IBM Rational Rhapsody Design Manager versions prior to 4.0.7 and 5.x prior to 5.0.1
Description
A cross-site request forgery (CSRF) issue allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Recommendations
For IBM Configuration Management Application (aka VVC) versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Configuration Management Application (aka VVC) version 5.x prior to 5.0.1, update to version 5.0.1 or later.
For IBM Rational Engineering Lifecycle Manager versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Rational Engineering Lifecycle Manager version 5.x prior to 5.0.1, update to version 5.0.1 or later.
For IBM Rational Software Architect Design Manager versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Rational Software Architect Design Manager version 5.x prior to 5.0.1, update to version 5.0.1 or later.
For IBM Rational Rhapsody Design Manager versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Rational Rhapsody Design Manager version 5.x prior to 5.0.1, update to version 5.0.1 or later.
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ibm Configuration Management Application
Ibm Rational Engineering Lifecycle Manager
Rational Rhapsody Design Manager
Ibm Rational Software Architect Design Manager