CVE-2020-4691: XSS

Q: What is the severity of CVE-2020-4691?

The severity of CVE-2020-4691 is medium.

Q: What is the impact of CVE-2020-4691?

CVE-2020-4691 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Q: Which versions of IBM Engineering Workflow Management are affected by CVE-2020-4691?

IBM Engineering Workflow Management versions 7.0 and 7.0.1 are affected by CVE-2020-4691.

Q: What is cross-site scripting (XSS)?

Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.

Q: How can I fix CVE-2020-4691?

Apply the necessary patches or updates provided by IBM to fix CVE-2020-4691.

Published Jan 7, 2021

Updated

IBM Engineering Workflow Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186698.

Affected Software

67 affected components

IBM RMM<=6.0.6.1

IBM RMM<=6.0.6

IBM RMM<=7.0

IBM RMM<=7.0.1

IBM RMM<=6.0.2

IBM RELM<=6.0.6.1

IBM RELM<=6.0.6

IBM ENI<=7.0

IBM ENI<=7.0.1

IBM RELM<=6.0.2

IBM EWM<=7.0.1

IBM RTC<=6.0.6

IBM RTC<=6.0.2

IBM RTC<=6.0.6.1

IBM EWM<=7.0

IBM CLM<=6.0.6.1

IBM CLM<=6.0.6

IBM ELM<=7.0

IBM ELM<=7.0.1

IBM CLM<=6.0.2

IBM Rhapsody DM<=6.0.6

IBM Rhapsody DM<=6.0.6.1

IBM Rhapsody DM<=6.0.2

IBM RDM<=7.0

IBM RDM<=7.0.1

IBM RQM<=6.0.6.1

IBM RQM<=6.0.6

IBM ETM<=7.0.0

IBM RQM<=6.0.2

IBM RDNG<=6.0.2

IBM DOORS Next<=7.0

IBM DOORS Next<=7.0.1

IBM RDNG<=6.0.6.1

IBM RDNG<=6.0.6

IBM Collaborative Lifecycle Management=6.0.2

IBM Collaborative Lifecycle Management=6.0.6

IBM Collaborative Lifecycle Management=6.0.6.1

IBM DOORS Next=7.0

IBM DOORS Next=7.0.1

IBM Engineering Insights=7.0

IBM Engineering Insights=7.0.1

IBM Engineering Lifecycle Management=7.0

IBM Engineering Lifecycle Management=7.0.1

IBM Engineering Test Management=7.0.0

IBM Engineering Workflow Management=7.0

IBM Engineering Workflow Management=7.0.1

IBM Rational DOORS Next Generation=6.0.2

IBM Rational DOORS Next Generation=6.0.6

IBM Rational DOORS Next Generation=6.0.6.1

IBM Rational Engineering Lifecycle Manager=6.0.6

IBM Rational Engineering Lifecycle Manager=6.0.6.1

IBM Rational Quality Manager=6.0.2

IBM Rational Quality Manager=6.0.6

IBM Rational Quality Manager=6.0.6.1

IBM Rational Rhapsody Design Manager=6.0.2

IBM Rational Rhapsody Design Manager=6.0.6

IBM Rational Rhapsody Design Manager=6.0.6.1

IBM Rational Team Concert=6.0.2

IBM Rational Team Concert=6.0.6

IBM Rational Team Concert=6.0.6.1

IBM Reference Data Management=7.0

IBM Reference Data Management=7.0.1

IBM Rhapsody Model Manager=6.0.2

IBM Rhapsody Model Manager=6.0.6

IBM Rhapsody Model Manager=6.0.6.1

IBM Rhapsody Model Manager=7.0

IBM Rhapsody Model Manager=7.0.1

Event History

Jan 7, 2021

CVE Published

via IBM·12:00 AM

Jan 8, 2021

CVE Published

via MITRE·08:40 PM

Data Sourced

via MITRE·08:40 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6398742

Frequently Asked Questions

What is the severity of CVE-2020-4691?

The severity of CVE-2020-4691 is medium.

What is the impact of CVE-2020-4691?

CVE-2020-4691 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Which versions of IBM Engineering Workflow Management are affected by CVE-2020-4691?