PT-2012-1518 · Ibm · Ibm Rational Clearquest

Jan Kaestle · Published 2012-05-14 · Updated 2017-08-17 · CVE-2011-1390

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 7.1.1.x through 7.1.1.8 IBM Rational ClearQuest versions 7.1.2.x through 7.1.2.5 IBM Rational ClearQuest versions 8.x through 8.0.0.1

Description A SQL injection issue exists in the Maintenance tool of IBM Rational ClearQuest, allowing remote attackers to execute arbitrary SQL commands. This is due to an error in the user-database upgrade feature.

Recommendations For IBM Rational ClearQuest versions 7.1.1.x through 7.1.1.8, update to version 7.1.1.9 or later. For IBM Rational ClearQuest versions 7.1.2.x through 7.1.2.5, update to version 7.1.2.6 or later. For IBM Rational ClearQuest versions 8.x through 8.0.0.1, update to version 8.0.0.2 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-1390

Affected Products

Ibm Rational Clearquest

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-1390 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21594717 · Vendor Advisory
• http://securityfocus.com/bid/53483 · Note
• http://secunia.com/advisories/49093 · Note
• http://osvdb.org/81815 · Note
• http://securitytracker.com/id?1027060 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71802 · Note