CVE-2020-5004: XSS

Q: What is the vulnerability ID for this IBM Jazz Foundation vulnerability?

The vulnerability ID for this IBM Jazz Foundation vulnerability is CVE-2020-5004.

Q: What is the severity of CVE-2020-5004?

The severity of CVE-2020-5004 is medium with a CVSS score of 5.4.

Q: What is the affected software for CVE-2020-5004?

The affected software for CVE-2020-5004 includes IBM EWM versions up to 7.0.1, IBM RTC versions up to 6.0.6.1, and other related products.

Q: How can I fix this vulnerability?

To fix this vulnerability, IBM recommends applying the appropriate fixes and patches provided by IBM Security.

Published Jul 27, 2021

Updated

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.

Affected Software

53 affected components

IBM EWM<=7.0.1

IBM RTC<=6.0.6.1

IBM EWM<=7.0

IBM RTC<=6.0.6

IBM EWM<=7.0.2

IBM DOORS Next<=7.0.2

IBM DOORS Next<=7.0

IBM DOORS Next<=7.0.1

IBM RDNG<=6.0.6.1

IBM RDNG<=6.0.6

IBM Engineering Requirements Quality Assistant On-Premises<=All

IBM RELM<=6.0.6.1

IBM ENI<=7.0.1

IBM RELM<=6.0.6

IBM ENI<=7.0

IBM RELM<=6.0.2

IBM ENI<=7.0.2

IBM RQM<=6.0.6.1

IBM ETM<=7.0.1

IBM RQM<=6.0.6

IBM ETM<=7.0.0

IBM ETM<=7.0.2

IBM CLM<=6.0.6.1

IBM CLM<=6.0.6

IBM ELM<=7.0

IBM CLM<=6.0.2

IBM ELM<=7.0.1

IBM ELM<=7.0.2

IBM Engineering Lifecycle Optimization - Engineering Insights=7.0

IBM Engineering Lifecycle Optimization - Engineering Insights=7.0.1

IBM Engineering Lifecycle Optimization - Engineering Insights=7.0.2

IBM Engineering Requirements Quality Assistant On-Premises

IBM Engineering Test Management=7.0.0

IBM Engineering Test Management=7.0.1

IBM Engineering Test Management=7.0.2

IBM Engineering Workflow Management=7.0

IBM Engineering Workflow Management=7.0.1

IBM Engineering Workflow Management=7.0.2

IBM Rational Collaborative Lifecycle Management=6.0.2

IBM Rational Collaborative Lifecycle Management=6.0.6

IBM Rational Collaborative Lifecycle Management=6.0.6.1

IBM Rational DOORS Next Generation=6.0.6

IBM Rational DOORS Next Generation=6.0.6.1

IBM Rational DOORS Next Generation=7.0

IBM Rational DOORS Next Generation=7.0.1

IBM Rational DOORS Next Generation=7.0.2

IBM Rational Engineering Lifecycle Manager=6.0.2

IBM Rational Engineering Lifecycle Manager=6.0.6

IBM Rational Engineering Lifecycle Manager=6.0.6.1

IBM Rational Quality Manager=6.0.6

IBM Rational Quality Manager=6.0.6.1

IBM Rational Team Concert=6.0.6

IBM Rational Team Concert=6.0.6.1

Event History

Jul 27, 2021

CVE Published

via IBM·12:00 AM

Jul 28, 2021

CVE Published

via MITRE·12:25 PM

Data Sourced

via MITRE·12:25 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6475919

Frequently Asked Questions

What is the vulnerability ID for this IBM Jazz Foundation vulnerability?

The vulnerability ID for this IBM Jazz Foundation vulnerability is CVE-2020-5004.

What is the severity of CVE-2020-5004?

The severity of CVE-2020-5004 is medium with a CVSS score of 5.4.

What is the affected software for CVE-2020-5004?

The affected software for CVE-2020-5004 includes IBM EWM versions up to 7.0.1, IBM RTC versions up to 6.0.6.1, and other related products.

What is the impact of this vulnerability?

This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

How can I fix this vulnerability?