CVE-2021-20504: XSS
IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-20504.
What products are affected by this vulnerability?
IBM Engineering Lifecycle Optimization - Engineering Insights, IBM EWM (Up to and including 7.0.2), IBM RTC (Up to and including 6.0.2 and 6.0.6.1), IBM RELM (Up to and including 6.0.6.1), IBM ENI (Up to and including 7.0.2), IBM Engineering Requirements Quality Assistant On-Premises (All versions), IBM Engineering Lifecycle Management (Up to and including 7.0.0), IBM Engineering Workflow Management (Up to and including 7.0.2), IBM Rational Engineering Lifecycle Manager (Up to and including 6.0.6.1), IBM Rational Team Concert (Up to and including 6.0.6.2).
What is the severity level of this vulnerability?
The severity level of this vulnerability is medium with a CVSS score of 5.4.
What is the description of this vulnerability?
This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
Are there any references for this vulnerability?
Yes, you can find references for this vulnerability at: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/198231) and [IBM Support](https://www.ibm.com/support/pages/node/6437579).