CVE-2016-2865: Infoleak

Published Jul 15, 2016

Updated

The GIT Integration component in IBM Rational Team Concert (RTC) 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 and Rational Collaborative Lifecycle Management 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 allows remote authenticated users to obtain sensitive information via a malformed request.

Affected Software

10 affected components

IBM Rational Team Concert=5.0.0

IBM Rational Team Concert=5.0.1

IBM Rational Team Concert=5.0.2

IBM Rational Collaborative Lifecycle Management=5.0.0

IBM Rational Collaborative Lifecycle Management=5.0.1

IBM Rational Collaborative Lifecycle Management=5.0.2

IBM Rational Team Concert=6.0.0

IBM Rational Team Concert=6.0.1

IBM Rational Collaborative Lifecycle Management=6.0.0

IBM Rational Collaborative Lifecycle Management=6.0.1

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21985865

Event History

Jul 15, 2016

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2865?

CVE-2016-2865 has been classified as a medium severity vulnerability.

How do I fix CVE-2016-2865?

To remediate CVE-2016-2865, upgrade to IBM Rational Team Concert version 5.0.2 iFix14, 6.0.1 iFix5 or higher.

Who is affected by CVE-2016-2865?

CVE-2016-2865 affects IBM Rational Team Concert versions 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5, as well as Rational Collaborative Lifecycle Management versions 5.x and 6.x prior to the specified fixes.

What type of information can be accessed due to CVE-2016-2865?

CVE-2016-2865 allows remote authenticated users to obtain sensitive information through a malformed request.

Is there a need for immediate action regarding CVE-2016-2865?

Yes, immediate action is recommended to patch CVE-2016-2865 to protect sensitive information from unauthorized access.