CVE-2015-0130: XSS

Published Jul 20, 2015

Updated

Cross-site scripting (XSS) vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager (RQM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert (RTC) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Requirements Composer (RRC) 4.x through 4.0.7; and Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Affected Software

53 affected components

IBM Rational DOORS Next Generation=4.0.0

IBM Rational DOORS Next Generation=4.0.1

IBM Rational DOORS Next Generation=4.0.2

IBM Rational DOORS Next Generation=4.0.3

IBM Rational DOORS Next Generation=4.0.4

IBM Rational DOORS Next Generation=4.0.5

IBM Rational DOORS Next Generation=4.0.6

IBM Rational DOORS Next Generation=4.0.7

IBM Rational DOORS Next Generation=5.0.0

IBM Rational DOORS Next Generation=5.0.1

IBM Rational Team Concert=4.0

IBM Rational Team Concert=4.0.0.1

IBM Rational Team Concert=4.0.0.2

IBM Rational Team Concert=4.0.1

IBM Rational Team Concert=4.0.2

IBM Rational Team Concert=4.0.3

IBM Rational Team Concert=4.0.4

IBM Rational Team Concert=4.0.5

IBM Rational Team Concert=4.0.6

IBM Rational Team Concert=4.0.7

IBM Rational Team Concert=5.0.0

IBM Rational Team Concert=5.0.1

IBM Rational Collaborative Lifecycle Management=4.0.0

IBM Rational Collaborative Lifecycle Management=4.0.1

IBM Rational Collaborative Lifecycle Management=4.0.2

IBM Rational Collaborative Lifecycle Management=4.0.3

IBM Rational Collaborative Lifecycle Management=4.0.4

IBM Rational Collaborative Lifecycle Management=4.0.5

IBM Rational Collaborative Lifecycle Management=4.0.6

IBM Rational Collaborative Lifecycle Management=4.0.7

IBM Rational Collaborative Lifecycle Management=5.0.0

IBM Rational Collaborative Lifecycle Management=5.0.1

IBM Rational Requirements Composer=4.0.0

IBM Rational Requirements Composer=4.0.0.1

IBM Rational Requirements Composer=4.0.0.2

IBM Rational Requirements Composer=4.0.1

IBM Rational Requirements Composer=4.0.2

IBM Rational Requirements Composer=4.0.3

IBM Rational Requirements Composer=4.0.4

IBM Rational Requirements Composer=4.0.5

IBM Rational Requirements Composer=4.0.6

IBM Rational Requirements Composer=4.0.7

IBM Rational Quality Manager=4.0

IBM Rational Quality Manager=4.0.0.1

IBM Rational Quality Manager=4.0.0.2

IBM Rational Quality Manager=4.0.1

IBM Rational Quality Manager=4.0.2

IBM Rational Quality Manager=4.0.3

IBM Rational Quality Manager=4.0.4

IBM Rational Quality Manager=4.0.5

IBM Rational Quality Manager=4.0.7

IBM Rational Quality Manager=5.0.0

IBM Rational Quality Manager=5.0.1

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21960407

Event History

Jul 20, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0130?

CVE-2015-0130 has a moderate severity level due to its potential for cross-site scripting attacks.

How do I fix CVE-2015-0130?

To fix CVE-2015-0130, you should upgrade to IBM Rational Collaborative Lifecycle Management version 4.0.7 IF6 or 5.0.2 IF5 or higher.

What software is affected by CVE-2015-0130?

CVE-2015-0130 affects multiple versions of IBM Rational DOORS Next Generation, Rational Team Concert, Rational Collaborative Lifecycle Management, and Rational Quality Manager.

What are the consequences of exploiting CVE-2015-0130?

Exploitation of CVE-2015-0130 can allow an attacker to execute arbitrary scripts in the context of a user, potentially leading to data theft or unauthorized actions.

When was CVE-2015-0130 announced?

CVE-2015-0130 was publicly announced in January 2015.