PT-2014-5094 · Ibm · Ibm Rational Clearquest
Published
2014-09-23
·
Updated
2017-08-29
·
CVE-2014-3105
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
IBM Rational ClearQuest versions 7.1 through 7.1.2.14
IBM Rational ClearQuest versions 8.0.0 through 8.0.0.11
IBM Rational ClearQuest versions 8.0.1 through 8.0.1.4
Description
The OSLC integration feature in the Web component provides different error messages for failed login attempts depending on whether the
username exists. This allows remote attackers to enumerate account names via a series of requests to the affected API endpoint.Recommendations
For IBM Rational ClearQuest versions 7.1 through 7.1.2.14, update to version 7.1.2.15.
For IBM Rational ClearQuest versions 8.0.0 through 8.0.0.11, update to version 8.0.0.12.
For IBM Rational ClearQuest versions 8.0.1 through 8.0.1.4, update to version 8.0.1.5.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ibm Rational Clearquest