CVE-2009-4357: Infoleak
CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4357?
The CVE-2009-4357 vulnerability is rated as high severity due to its potential to expose user passwords.
How do I fix CVE-2009-4357?
To mitigate CVE-2009-4357, upgrade to IBM Rational ClearQuest version 7.1.1 or later.
What is affected by CVE-2009-4357?
CVE-2009-4357 affects various versions of IBM Rational ClearQuest and some versions of IBM Rational ClearCase.
What vulnerabilities does CVE-2009-4357 exploit?
CVE-2009-4357 exploits improper handling of legacy URLs in IBM Rational ClearQuest's automatic login feature.
Is there a workaround for CVE-2009-4357?
A temporary workaround for CVE-2009-4357 could involve disabling automatic login or restricting access to legacy URLs.