CVE-2020-4524: XSS

Q: What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2020-4524.

Q: What is the severity of CVE-2020-4524?

The severity of CVE-2020-4524 is medium with a severity value of 5.4.

Q: Which products are affected by CVE-2020-4524?

IBM Jazz Foundation products like EWM, RTC, RDNG, Rhapsody DM, RDM, RMM, CLM, ELM, RQM, ENI, Global Configuration Management, RELM, and Engineering Workflow Management, are affected by CVE-2020-4524.

Q: What is the risk of CVE-2020-4524?

CVE-2020-4524 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Q: Is there a fix available for CVE-2020-4524?

Yes, IBM has provided a fix for CVE-2020-4524. Please refer to the IBM support page for more information.

Published Jan 26, 2021

Updated

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182434.

Affected Software

60 affected components

IBM Collaborative Lifecycle Management=6.0.2

IBM Collaborative Lifecycle Management=6.0.6

IBM Collaborative Lifecycle Management=6.0.6.1

IBM Engineering Insights=7.0

IBM Engineering Lifecycle Management=7.0

IBM Engineering Requirements Management DOORS Next=6.0.2

IBM Engineering Requirements Management DOORS Next=6.0.6

IBM Engineering Requirements Management DOORS Next=6.0.6.1

IBM Engineering Requirements Management DOORS Next=7.0

IBM Engineering Test Management=7.0.0

IBM Engineering Workflow Management=6.0.2

IBM Engineering Workflow Management=6.0.6

IBM Engineering Workflow Management=6.0.6.1

IBM Engineering Workflow Management=7.0

IBM Engineering Workflow Management=7.0.2

IBM Global Configuration Management

IBM Rational Engineering Lifecycle Manager=6.0.2

IBM Rational Engineering Lifecycle Manager=6.0.6

IBM Rational Engineering Lifecycle Manager=6.0.6.1

IBM Rational Quality Manager=6.0.2

IBM Rational Quality Manager=6.0.6

IBM Rational Quality Manager=6.0.6.1

IBM Rhapsody Design Manager=6.0.2

IBM Rhapsody Design Manager=6.0.6

IBM Rhapsody Design Manager=6.0.6.1

IBM Rhapsody Design Manager=7.0

IBM Rhapsody Model Manager=6.0.2

IBM Rhapsody Model Manager=6.0.6

IBM Rhapsody Model Manager=6.0.6.1

IBM Rhapsody Model Manager=7.0

IBM EWM<=7.0.2

IBM RTC<=6.0.2

IBM RTC<=6.0.6.1

IBM EWM<=7.0

IBM RTC<=6.0.6

IBM RDNG<=6.0.2

IBM DOORS Next<=7.0

IBM RDNG<=6.0.6.1

IBM RDNG<=6.0.6

IBM Rhapsody DM<=6.0.6

IBM Rhapsody DM<=6.0.6.1

IBM Rhapsody DM<=6.0.2

IBM RDM<=7.0

IBM RMM<=6.0.6.1

IBM RMM<=6.0.6

IBM RMM<=7.0

IBM RMM<=6.0.2

IBM CLM<=6.0.6.1

IBM CLM<=6.0.6

IBM ELM<=7.0

IBM CLM<=6.0.2

IBM RQM<=6.0.6.1

IBM RQM<=6.0.6

IBM ETM<=7.0.0

IBM RQM<=6.0.2

IBM RELM<=6.0.6.1

IBM RELM<=6.0.6

IBM ENI<=7.0

IBM RELM<=6.0.2

IBM Global Configuration Management<=All

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6408694

Event History

Jan 26, 2021

CVE Published

via IBM·12:00 AM

Jan 27, 2021

CVE Published

via MITRE·04:15 PM

Data Sourced

via MITRE·04:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6408694

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2020-4524.

What is the severity of CVE-2020-4524?