PT-2009-5985 · Ibm · Ibm Rational Requisitepro

Published 2009-10-20 · Updated 2009-10-27 · CVE-2009-3730

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational RequisitePro version 7.1.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help feature of IBM Rational RequisitePro. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in certain API endpoints. The affected endpoints include "ReqWebHelp/advanced/workingSet.jsp" where the operation parameter is vulnerable, and "ReqWebHelp/basic/searchView.jsp" where the searchWord, maxHits, scopedSearch, and scope parameters are vulnerable.

Recommendations For IBM Rational RequisitePro version 7.1.0, consider disabling the ReqWeb Help feature until a patch is available. Restrict access to the vulnerable API endpoints "ReqWebHelp/advanced/workingSet.jsp" and "ReqWebHelp/basic/searchView.jsp" to minimize the risk of exploitation. Avoid using the operation, searchWord, maxHits, scopedSearch, and scope parameters in the affected endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3730

Affected Products

Ibm Rational Requisitepro

References · 10

• 🔥 http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895 · Exploit
• 🔥 https://exploit-db.com/exploits/33293 · Exploit
• 🔥 http://securityfocus.com/bid/36721 · Exploit
• 🔥 https://exploit-db.com/exploits/33292 · Exploit
• 🔥 https://exploit-db.com/exploits/10094 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3730 · Security Note
• http://vupen.com/english/advisories/2009/2958 · Vendor Advisory
• http://secunia.com/advisories/37052 · Vendor Advisory
• http://osvdb.org/59088 · Note
• http://osvdb.org/59089 · Note