CVE-2021-20503: XSS

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/198182
• https://www.ibm.com/support/pages/node/6437579 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6437579

Frequently Asked Questions

• What is CVE-2021-20503?

  CVE-2021-20503 is a vulnerability that allows users to embed arbitrary JavaScript code in the Web UI of IBM Engineering Lifecycle Optimization - Engineering Insights, potentially leading to credentials disclosure within a trusted session.

• Which products are affected by CVE-2021-20503?

  IBM EWM 7.0.2, IBM EWM 7.0.1, IBM RTC 6.0.2, IBM RTC 6.0.6.1, IBM EWM 7.0, IBM RTC 6.0.6, IBM RELM 6.0.6.1, IBM ENI 7.0.1, IBM RELM 6.0.6, IBM ENI 7.0.2, IBM Engineering Requirements Quality Assistant On-Premises, IBM ENI 7.0, IBM Engineering Lifecycle Management 7.0, IBM Engineering Workflow Management 7.0.0, IBM Engineering Workflow Management 7.0.1, IBM Engineering Workflow Management 7.0.2, IBM Rational Engineering Lifecycle Manager 6.0.2, IBM Rational Engineering Lifecycle Manager 6.0.6, IBM Rational Engineering Lifecycle Manager 6.0.6.1, IBM Rational Team Concert 6.0.6, IBM Rational Team Concert 6.0.6.1, IBM Rational Team Concert 6.0.6.2.

• What is the severity of CVE-2021-20503?

  The severity of CVE-2021-20503 is medium with a CVSS score of 5.4.

• How can I fix CVE-2021-20503?

  Apply the latest security patches provided by IBM to the affected products.

• Where can I find more information about CVE-2021-20503?

  You can find more information about CVE-2021-20503 at the following references: [Reference 1](https://exchange.xforce.ibmcloud.com/vulnerabilities/198182), [Reference 2](https://www.ibm.com/support/pages/node/6437579).