CVE-2015-7471: XSS
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Quality Manager (RQM) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Team Concert (RTC) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Requirements Composer (RRC) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1 and 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, and 4.0.7 before iFix10, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; and Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4 allows remote authenticated users with project administrator privileges to inject arbitrary web script or HTML via a crafted project. IBM X-Force ID: 108429.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2015-7471.
What is the severity of CVE-2015-7471?
The severity of CVE-2015-7471 is medium with a CVSS score of 4.8.
Which software products are affected by CVE-2015-7471?
The following IBM software products are affected by CVE-2015-7471: IBM Rational Collaborative Lifecycle Management, IBM Rational Quality Manager, IBM Rational Team Concert, IBM Rational Requirements Composer, IBM Rational DOORS Next Generation, IBM Rational Engineering Lifecycle Manager, IBM Rational Rhapsody Design Manager, and IBM Rational Software Architect Design Manager.
How can I fix CVE-2015-7471?
To fix CVE-2015-7471, you should upgrade to IBM Rational Collaborative Lifecycle Management 3.0.1.6 iFix7 Interim Fix 1, 4.0.7 iFix10, 5.0.2 iFix15, or 6.0.1 iFix4 (or higher).
Where can I find more information about CVE-2015-7471?
You can find more information about CVE-2015-7471 on the IBM website or the IBM X-Force Exchange website.