CVE-2020-4697: XSS

Q: What is CVE-2020-4697?

CVE-2020-4697 is a vulnerability in IBM Engineering Workflow Management that allows for cross-site scripting.

Q: How does CVE-2020-4697 affect IBM Jazz Foundation products?

CVE-2020-4697 affects IBM Jazz Foundation products by allowing users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure.

Q: What is the severity of CVE-2020-4697?

The severity of CVE-2020-4697 is medium with a CVSS score of 5.4.

Q: Which versions of IBM Engineering Workflow Management are affected by CVE-2020-4697?

Versions 7.0 and 7.0.1 of IBM Engineering Workflow Management are affected by CVE-2020-4697.

Q: How can I fix CVE-2020-4697 in IBM Engineering Workflow Management?

To fix CVE-2020-4697 in IBM Engineering Workflow Management, it is recommended to apply the latest security updates provided by IBM.

Published Jan 7, 2021

Updated

IBM Engineering Workflow Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186790.

Affected Software

67 affected components

IBM RMM<=6.0.6.1

IBM RMM<=6.0.6

IBM RMM<=7.0

IBM RMM<=7.0.1

IBM RMM<=6.0.2

IBM RELM<=6.0.6.1

IBM RELM<=6.0.6

IBM ENI<=7.0

IBM ENI<=7.0.1

IBM RELM<=6.0.2

IBM EWM<=7.0.1

IBM RTC<=6.0.6

IBM RTC<=6.0.2

IBM RTC<=6.0.6.1

IBM EWM<=7.0

IBM CLM<=6.0.6.1

IBM CLM<=6.0.6

IBM ELM<=7.0

IBM ELM<=7.0.1

IBM CLM<=6.0.2

IBM Rhapsody DM<=6.0.6

IBM Rhapsody DM<=6.0.6.1

IBM Rhapsody DM<=6.0.2

IBM RDM<=7.0

IBM RDM<=7.0.1

IBM RQM<=6.0.6.1

IBM RQM<=6.0.6

IBM ETM<=7.0.0

IBM RQM<=6.0.2

IBM RDNG<=6.0.2

IBM DOORS Next<=7.0

IBM DOORS Next<=7.0.1

IBM RDNG<=6.0.6.1

IBM RDNG<=6.0.6

IBM Collaborative Lifecycle Management=6.0.2

IBM Collaborative Lifecycle Management=6.0.6

IBM Collaborative Lifecycle Management=6.0.6.1

IBM DOORS Next=7.0

IBM DOORS Next=7.0.1

IBM Engineering Insights=7.0

IBM Engineering Insights=7.0.1

IBM Engineering Lifecycle Management=7.0

IBM Engineering Lifecycle Management=7.0.1

IBM Engineering Test Management=7.0.0

IBM Engineering Workflow Management=7.0

IBM Engineering Workflow Management=7.0.1

IBM Rational DOORS Next Generation=6.0.2

IBM Rational DOORS Next Generation=6.0.6

IBM Rational DOORS Next Generation=6.0.6.1

IBM Rational Engineering Lifecycle Manager=6.0.6

IBM Rational Engineering Lifecycle Manager=6.0.6.1

IBM Rational Quality Manager=6.0.2

IBM Rational Quality Manager=6.0.6

IBM Rational Quality Manager=6.0.6.1

IBM Rational Rhapsody Design Manager=6.0.2

IBM Rational Rhapsody Design Manager=6.0.6

IBM Rational Rhapsody Design Manager=6.0.6.1

IBM Rational Team Concert=6.0.2

IBM Rational Team Concert=6.0.6

IBM Rational Team Concert=6.0.6.1

IBM Reference Data Management=7.0

IBM Reference Data Management=7.0.1

IBM Rhapsody Model Manager=6.0.2

IBM Rhapsody Model Manager=6.0.6

IBM Rhapsody Model Manager=6.0.6.1

IBM Rhapsody Model Manager=7.0

IBM Rhapsody Model Manager=7.0.1

Event History

Jan 7, 2021

CVE Published

via IBM·12:00 AM

Jan 8, 2021

CVE Published

via MITRE·08:40 PM

Data Sourced

via MITRE·08:40 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6398742

Frequently Asked Questions

What is CVE-2020-4697?

CVE-2020-4697 is a vulnerability in IBM Engineering Workflow Management that allows for cross-site scripting.

How does CVE-2020-4697 affect IBM Jazz Foundation products?

CVE-2020-4697 affects IBM Jazz Foundation products by allowing users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure.

What is the severity of CVE-2020-4697?