PT-2021-12149 · Ibm · Ibm Engineering Requirements Quality Assistant On-Premises

Published 2021-01-08 · Updated 2021-01-11 · CVE-2020-4663

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Quality Assistant On-Premises (affected versions not specified)

Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is due to a cross-site scripting vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-4663

Affected Products

Ibm Engineering Requirements Quality Assistant On-Premises

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/186234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4663 · Security Note
• https://ibm.com/support/pages/node/6398724 · Vendor Advisory
• https://t.me/cibsecurity/21818 · Telegram Post