CVE-2020-4975: XSS
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435.
Other sources
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this cross-site scripting vulnerability?
The vulnerability ID is CVE-2020-4975.
Which products are affected by the CVE-2020-4975 vulnerability?
The following IBM products are affected: IBM RDNG (version up to 6.0.2), IBM DOORS Next (version up to 7.0.2), IBM PUB (version up to 7.0.2), IBM EWM (version up to 7.0.2), IBM RTC (version up to 6.0.6.1), IBM Global Configuration Management (all versions), IBM ETM (version up to 7.0.2), IBM RQM (version up to 6.0.6.1), IBM Engineering Requirements Quality Assistant On-Premises (all versions), IBM Engineering Test Management (version up to 7.0.2), and IBM Engineering Workflow Management (version up to 7.0.2).
What is the severity of the CVE-2020-4975 vulnerability?
The severity of the CVE-2020-4975 vulnerability is medium, with a CVSS score of 5.4.
How does the CVE-2020-4975 vulnerability work?
The vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
Are there any fixes or patches available for the CVE-2020-4975 vulnerability?
Yes, IBM has provided fixes for the affected products. Please refer to the IBM support pages for more information and to download the necessary patches.