PT-2018-4416 · Ibm · Ibm Rational Team Concert+7

Published 2018-03-15 · Updated 2018-04-10 · CVE-2015-7453

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational Collaborative Lifecycle Management (CLM) versions 3.0.1 through 3.0.1.6 iFix7 Interim Fix 1, versions 4.0.x through 4.0.7 iFix10, versions 5.0.x through 5.0.2 iFix15, and versions 6.0.x through 6.0.1 iFix4 IBM Rational Quality Manager (RQM) versions 3.0.x through 3.0.1.6 iFix7 Interim Fix 1, versions 4.0.x through 4.0.7 iFix10, versions 5.0.x through 5.0.2 iFix15, and versions 6.0.x through 6.0.1 iFix4 IBM Rational Team Concert (RTC) versions 3.0.x through 3.0.1.6 iFix7 Interim Fix 1, versions 4.0.x through 4.0.7 iFix10, versions 5.0.x through 5.0.2 iFix15, and versions 6.0.x through 6.0.1 iFix4 IBM Rational Requirements Composer (RRC) versions 3.0.x through 3.0.1.6 iFix7 Interim Fix 1 and versions 4.0.x through 4.0.7 iFix10 IBM Rational DOORS Next Generation (RDNG) versions 4.0.x through 4.0.7 iFix10, versions 5.0.x through 5.0.2 iFix15, and versions 6.0.x through 6.0.1 iFix4 IBM Rational Engineering Lifecycle Manager (RELM) versions 4.0.3 through 4.0.7 before iFix10, versions 5.0.x through 5.0.2 iFix1, and versions 6.0.x through 6.0.2 IBM Rational Rhapsody Design Manager (Rhapsody DM) versions 4.0.x through 4.0.7 iFix10, versions 5.0.x through 5.0.2 iFix15, and versions 6.0.x through 6.0.1 iFix4 IBM Rational Software Architect Design Manager (RSA DM) versions 4.0.x through 4.0.7 iFix10, versions 5.0.x through 5.0.2 iFix15, and versions 6.0.x through 6.0.1 iFix4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially affect a large number of devices worldwide, although the exact number is not specified.

Recommendations For IBM Rational Collaborative Lifecycle Management (CLM) versions 3.0.1 through 3.0.1.6 iFix7 Interim Fix 1, update to version 3.0.1.6 iFix7 Interim Fix 1 or later. For IBM Rational Collaborative Lifecycle Management (CLM) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational Collaborative Lifecycle Management (CLM) versions 5.0.x through 5.0.2 iFix15, update to version 5.0.2 iFix15 or later. For IBM Rational Collaborative Lifecycle Management (CLM) versions 6.0.x through 6.0.1 iFix4, update to version 6.0.1 iFix4 or later. For IBM Rational Quality Manager (RQM) versions 3.0.x through 3.0.1.6 iFix7 Interim Fix 1, update to version 3.0.1.6 iFix7 Interim Fix 1 or later. For IBM Rational Quality Manager (RQM) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational Quality Manager (RQM) versions 5.0.x through 5.0.2 iFix15, update to version 5.0.2 iFix15 or later. For IBM Rational Quality Manager (RQM) versions 6.0.x through 6.0.1 iFix4, update to version 6.0.1 iFix4 or later. For IBM Rational Team Concert (RTC) versions 3.0.x through 3.0.1.6 iFix7 Interim Fix 1, update to version 3.0.1.6 iFix7 Interim Fix 1 or later. For IBM Rational Team Concert (RTC) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational Team Concert (RTC) versions 5.0.x through 5.0.2 iFix15, update to version 5.0.2 iFix15 or later. For IBM Rational Team Concert (RTC) versions 6.0.x through 6.0.1 iFix4, update to version 6.0.1 iFix4 or later. For IBM Rational Requirements Composer (RRC) versions 3.0.x through 3.0.1.6 iFix7 Interim Fix 1, update to version 3.0.1.6 iFix7 Interim Fix 1 or later. For IBM Rational Requirements Composer (RRC) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational DOORS Next Generation (RDNG) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational DOORS Next Generation (RDNG) versions 5.0.x through 5.0.2 iFix15, update to version 5.0.2 iFix15 or later. For IBM Rational DOORS Next Generation (RDNG) versions 6.0.x through 6.0.1 iFix4, update to version 6.0.1 iFix4 or later. For IBM Rational Engineering Lifecycle Manager (RELM) versions 4.0.3 through 4.0.7 before iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational Engineering Lifecycle Manager (RELM) versions 5.0.x through 5.0.2 iFix1, update to version 5.0.2 iFix1 or later. For IBM Rational Engineering Lifecycle Manager (RELM) versions 6.0.x through 6.0.2, update to version 6.0.2 or later. For IBM Rational Rhapsody Design Manager (Rhapsody DM) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational Rhapsody Design Manager (Rhapsody DM) versions 5.0.x through 5.0.2 iFix15, update to version 5.0.2 iFix15 or later. For IBM Rational Rhapsody Design Manager (Rhapsody DM) versions 6.0.x through 6.0.1 iFix4, update to version 6.0.1 iFix4 or later. For IBM Rational Software Architect Design Manager (RSA DM) versions 4.0.x through 4.0.7 iFix10, update to version 4.0.7 iFix10 or later. For IBM Rational Software Architect Design Manager (RSA DM) versions 5.0.x through 5.0.2 iFix15, update to version 5.0.2 iFix15 or later. For IBM Rational Software Architect Design Manager (RSA DM) versions 6.0.x through 6.0.1 iFix4, update to version 6.0.1 iFix4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-7453

Affected Products

Ibm Rational Collaborative Lifecycle Management

Ibm Rational Doors Next Generation

Ibm Rational Engineering Lifecycle Manager

Ibm Rational Quality Manager

Ibm Rational Requirements Composer

Rational Rhapsody Design Manager

Ibm Rational Software Architect Design Manager

Ibm Rational Team Concert

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-7453 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/108296 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21982747 · Vendor Advisory