CVE-2017-1281: XSS

Published Jul 3, 2018

Updated

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124759.

Affected Software

18 affected components

IBM Rational Quality Manager=5.0.0

IBM Rational Quality Manager=5.0.1

IBM Rational Quality Manager=5.0.2

IBM Rational Quality Manager=6.0.0

IBM Rational Quality Manager=6.0.1

IBM Rational Quality Manager=6.0.2

IBM Rational Quality Manager=6.0.3

IBM Rational Quality Manager=6.0.4

IBM Rational Quality Manager=6.0.5

IBM Rational Collaborative Lifecycle Management=5.0.0

IBM Rational Collaborative Lifecycle Management=5.0.1

IBM Rational Collaborative Lifecycle Management=5.0.2

IBM Rational Collaborative Lifecycle Management=6.0.0

IBM Rational Collaborative Lifecycle Management=6.0.1

IBM Rational Collaborative Lifecycle Management=6.0.2

IBM Rational Collaborative Lifecycle Management=6.0.3

IBM Rational Collaborative Lifecycle Management=6.0.4

IBM Rational Collaborative Lifecycle Management=6.0.5

Event History

Jul 3, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2017-1281?

CVE-2017-1281 has a CVSS base score indicating a medium severity vulnerability.

How do I fix CVE-2017-1281?

To fix CVE-2017-1281, upgrade IBM Rational Quality Manager or IBM Rational Collaborative Lifecycle Management to a version that addresses this vulnerability.

What versions are affected by CVE-2017-1281?

CVE-2017-1281 affects IBM Rational Quality Manager versions 5.0.0 to 5.0.2 and 6.0.0 to 6.0.5, as well as IBM Rational Collaborative Lifecycle Management versions 5.0.0 to 5.0.2 and 6.0.0 to 6.0.5.

What type of vulnerability is CVE-2017-1281?

CVE-2017-1281 is a cross-site scripting (XSS) vulnerability.

What impact does CVE-2017-1281 have on users?

CVE-2017-1281 allows attackers to embed arbitrary JavaScript code, potentially altering the user interface and functionality of affected applications.