CVE-2016-6037: XSS
IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains malicious HTML code, which when the project is viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 116918.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6037?
The severity of CVE-2016-6037 is considered high due to the ability for an attacker to execute arbitrary HTML code in the context of the victim's browser.
How do I fix CVE-2016-6037?
To fix CVE-2016-6037, update to a patched version of IBM Rational Team Concert or Rational Quality Manager as provided by IBM.
Who is affected by CVE-2016-6037?
CVE-2016-6037 affects users of IBM Rational Team Concert and IBM Rational Quality Manager versions 4.0.0 to 6.0.2.
What type of attack is CVE-2016-6037?
CVE-2016-6037 is an HTML injection vulnerability that allows attackers with project administrator privileges to embed malicious HTML.
What are the potential impacts of CVE-2016-6037?
The potential impacts of CVE-2016-6037 include unauthorized exposure of sensitive information and potential session hijacking.