CVE-2020-4733: XSS

Q: What is CVE-2020-4733?

CVE-2020-4733 is a vulnerability in IBM Engineering Test Management that allows for cross-site scripting.

Q: How does CVE-2020-4733 affect IBM Jazz Foundation products?

CVE-2020-4733 allows users to embed arbitrary JavaScript code in the Web UI of IBM Jazz Foundation products, potentially leading to credentials disclosure within a trusted session.

Q: What is the severity of CVE-2020-4733?

CVE-2020-4733 has a severity level of medium (5.4).

Q: Which versions of IBM Collaborative Lifecycle Management are affected by CVE-2020-4733?

IBM Collaborative Lifecycle Management versions 6.0.2, 6.0.6, and 6.0.6.1 are affected by CVE-2020-4733.

Q: How can I fix CVE-2020-4733?

To fix CVE-2020-4733, it is recommended to apply the necessary patches or updates provided by IBM.

Published Jan 7, 2021

Updated

IBM Engineering Test Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127.

Affected Software

67 affected components

IBM RMM<=6.0.6.1

IBM RMM<=6.0.6

IBM RMM<=7.0

IBM RMM<=7.0.1

IBM RMM<=6.0.2

IBM RELM<=6.0.6.1

IBM RELM<=6.0.6

IBM ENI<=7.0

IBM ENI<=7.0.1

IBM RELM<=6.0.2

IBM EWM<=7.0.1

IBM RTC<=6.0.6

IBM RTC<=6.0.2

IBM RTC<=6.0.6.1

IBM EWM<=7.0

IBM CLM<=6.0.6.1

IBM CLM<=6.0.6

IBM ELM<=7.0

IBM ELM<=7.0.1

IBM CLM<=6.0.2

IBM Rhapsody DM<=6.0.6

IBM Rhapsody DM<=6.0.6.1

IBM Rhapsody DM<=6.0.2

IBM RDM<=7.0

IBM RDM<=7.0.1

IBM RQM<=6.0.6.1

IBM RQM<=6.0.6

IBM ETM<=7.0.0

IBM RQM<=6.0.2

IBM RDNG<=6.0.2

IBM DOORS Next<=7.0

IBM DOORS Next<=7.0.1

IBM RDNG<=6.0.6.1

IBM RDNG<=6.0.6

IBM Collaborative Lifecycle Management=6.0.2

IBM Collaborative Lifecycle Management=6.0.6

IBM Collaborative Lifecycle Management=6.0.6.1

IBM DOORS Next=7.0

IBM DOORS Next=7.0.1

IBM Engineering Insights=7.0

IBM Engineering Insights=7.0.1

IBM Engineering Lifecycle Management=7.0

IBM Engineering Lifecycle Management=7.0.1

IBM Engineering Test Management=7.0.0

IBM Engineering Workflow Management=7.0

IBM Engineering Workflow Management=7.0.1

IBM Rational DOORS Next Generation=6.0.2

IBM Rational DOORS Next Generation=6.0.6

IBM Rational DOORS Next Generation=6.0.6.1

IBM Rational Engineering Lifecycle Manager=6.0.6

IBM Rational Engineering Lifecycle Manager=6.0.6.1

IBM Rational Quality Manager=6.0.2

IBM Rational Quality Manager=6.0.6

IBM Rational Quality Manager=6.0.6.1

IBM Rational Rhapsody Design Manager=6.0.2

IBM Rational Rhapsody Design Manager=6.0.6

IBM Rational Rhapsody Design Manager=6.0.6.1

IBM Rational Team Concert=6.0.2

IBM Rational Team Concert=6.0.6

IBM Rational Team Concert=6.0.6.1

IBM Reference Data Management=7.0

IBM Reference Data Management=7.0.1

IBM Rhapsody Model Manager=6.0.2

IBM Rhapsody Model Manager=6.0.6

IBM Rhapsody Model Manager=6.0.6.1

IBM Rhapsody Model Manager=7.0

IBM Rhapsody Model Manager=7.0.1

Event History

Jan 7, 2021

CVE Published

via IBM·12:00 AM

Jan 8, 2021

CVE Published

via MITRE·08:40 PM

Data Sourced

via MITRE·08:40 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6398742

Frequently Asked Questions

What is CVE-2020-4733?

CVE-2020-4733 is a vulnerability in IBM Engineering Test Management that allows for cross-site scripting.

How does CVE-2020-4733 affect IBM Jazz Foundation products?

CVE-2020-4733 allows users to embed arbitrary JavaScript code in the Web UI of IBM Jazz Foundation products, potentially leading to credentials disclosure within a trusted session.

What is the severity of CVE-2020-4733?