CVE-2018-1688: XSS
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145509.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-1688?
CVE-2018-1688 is a vulnerability in IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) that allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure.
How severe is CVE-2018-1688?
CVE-2018-1688 has a severity rating of 5.4, which is considered medium.
Which software versions are affected by CVE-2018-1688?
IBM Rational Collaborative Lifecycle Management versions 5.0 through 6.0.6, IBM Rational DOORS Next Generation versions 5.0 through 6.0.6, IBM Rational Engineering Lifecycle Manager versions 5.0 through 6.0.6, IBM Rational Quality Manager versions 5.0 through 6.0.6, IBM Rational Rhapsody Design Manager versions 5.0 through 6.0.6, IBM Rational Software Architect Design Manager versions 5.0 through 6.0.1, and IBM Rational Team Concert versions 5.0 through 6.0.6 are affected by CVE-2018-1688.
How can CVE-2018-1688 be exploited?
CVE-2018-1688 can be exploited by injecting arbitrary JavaScript code into the Web UI of affected software versions, which can alter the intended functionality and potentially lead to disclosure of credentials.
Is there a fix available for CVE-2018-1688?
Yes, IBM has released fixes for the affected software versions to address the vulnerability. It is recommended to update to the latest available version.