CVE-2020-4295: XSS
First published: Wed Jun 17 2020(Updated: )
IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176408.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DOORS Next | =7.0 | |
| IBM Rational DOORS Next Generation | =6.0.2 | |
| IBM Rational DOORS Next Generation | =6.0.6 | |
| IBM Rational DOORS Next Generation | =6.0.6.1 | |
| <=6.0.2 | ||
| <=6.0.6.1 | ||
| <=6.0.6 | ||
| <=7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is IBM DOORS Next Generation (DNG/RRC) vulnerability CVE-2020-4295?
IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
How does the vulnerability CVE-2020-4295 impact IBM DOORS Next Generation (DNG/RRC)?
The vulnerability allows an attacker to embed malicious JavaScript code in the Web UI, which can alter the intended functionality of the application and potentially result in credentials disclosure.
What is the severity level of vulnerability CVE-2020-4295?
The severity level of vulnerability CVE-2020-4295 is medium, with a CVSS score of 5.4.
Which versions of IBM DOORS Next Generation (DNG/RRC) are affected by vulnerability CVE-2020-4295?
Versions 6.0.2, 6.0.6, 6.0.6.1, and 7.0 of IBM DOORS Next Generation (DNG/RRC) are affected by vulnerability CVE-2020-4295.
How can the vulnerability CVE-2020-4295 be mitigated?
To mitigate the vulnerability CVE-2020-4295, IBM recommends applying the necessary fix packs or upgrading to a fixed version. Please refer to the IBM support page for detailed instructions and patches.
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm doors next
- version/ibm doors next/7.0
- canonical/ibm rational doors next generation
- version/ibm rational doors next generation/6.0.2
- version/ibm rational doors next generation/6.0.6
- version/ibm rational doors next generation/6.0.6.1
- canonical/ibm rdng
- version/ibm rdng/6.0.2
- version/ibm rdng/6.0.6.1
- version/ibm rdng/6.0.6