CVE-2017-1790: XSS

Published Apr 12, 2018

Updated

IBM DOORS Next Generation (DNG/RRC) 5.0, 5.0.1, 5.0.2, and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137035.

Affected Software

9 affected components

IBM Rational Requirements Composer=5.0

IBM Rational Requirements Composer=5.0.1

IBM Rational Requirements Composer=5.0.2

IBM Rational DOORS Next Generation=6.0.0

IBM Rational DOORS Next Generation=6.0.1

IBM Rational DOORS Next Generation=6.0.2

IBM Rational DOORS Next Generation=6.0.3

IBM Rational DOORS Next Generation=6.0.4

IBM Rational DOORS Next Generation=6.0.5

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22012660

Event History

Apr 12, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2017-1790?

CVE-2017-1790 is a vulnerability in IBM DOORS Next Generation (DNG/RRC) 5.0, 5.0.1, 5.0.2, and 6.0 through 6.0.5 that allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted environment.

How severe is CVE-2017-1790?

CVE-2017-1790 has a severity rating of 5.4 (medium).

Which software versions are affected by CVE-2017-1790?

The affected software versions are IBM Rational Requirements Composer 5.0, 5.0.1, and 5.0.2, as well as IBM Rational DOORS Next Generation 6.0 through 6.0.5.

What is the Common Weakness Enumeration (CWE) associated with CVE-2017-1790?

The CWE associated with CVE-2017-1790 is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

How can I fix the vulnerability in IBM DOORS Next Generation?

To fix the vulnerability, it is recommended to upgrade to a non-vulnerable version of IBM DOORS Next Generation.