PT-2014-5036 · Ibm · Ibm Rational Software Architect Design Manager+3
Published
2014-09-10
·
Updated
2017-08-29
·
CVE-2014-3037
CVSS v2.0
6.0
Medium
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
IBM Configuration Management Application (aka VVC) versions prior to 4.0.7 and 5.x prior to 5.0.1
IBM Rational Engineering Lifecycle Manager versions prior to 4.0.7 and 5.x prior to 5.0.1
IBM Rational Software Architect Design Manager versions prior to 4.0.7 and 5.x prior to 5.0.1
IBM Rational Rhapsody Design Manager versions prior to 4.0.7 and 5.x prior to 5.0.1
Description
A cross-site request forgery (CSRF) issue allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Recommendations
For IBM Configuration Management Application (aka VVC) versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Configuration Management Application (aka VVC) version 5.x prior to 5.0.1, update to version 5.0.1 or later.
For IBM Rational Engineering Lifecycle Manager versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Rational Engineering Lifecycle Manager version 5.x prior to 5.0.1, update to version 5.0.1 or later.
For IBM Rational Software Architect Design Manager versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Rational Software Architect Design Manager version 5.x prior to 5.0.1, update to version 5.0.1 or later.
For IBM Rational Rhapsody Design Manager versions prior to 4.0.7, update to version 4.0.7 or later.
For IBM Rational Rhapsody Design Manager version 5.x prior to 5.0.1, update to version 5.0.1 or later.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ibm Configuration Management Application
Ibm Rational Engineering Lifecycle Manager
Rational Rhapsody Design Manager
Ibm Rational Software Architect Design Manager