CVE-2021-20520: XSS

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/198572
• https://www.ibm.com/support/pages/node/6437579 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6437579

Frequently Asked Questions

• What is the vulnerability ID for this issue?

  The vulnerability ID for this issue is CVE-2021-20520.

• What is the severity of CVE-2021-20520?

  The severity of CVE-2021-20520 is medium with a CVSS score of 5.4.

• Which products and versions are affected by CVE-2021-20520?

  The following IBM products and versions are affected by CVE-2021-20520: IBM EWM 7.0.2, IBM EWM 7.0.1, IBM RTC 6.0.2, IBM RTC 6.0.6.1, IBM EWM 7.0, IBM RTC 6.0.6, IBM RELM 6.0.6.1, IBM ENI 7.0.1, IBM RELM 6.0.6, IBM ENI 7.0, IBM RELM 6.0.2, IBM ENI 7.0.2, IBM Engineering Requirements Quality Assistant On-Premises (All versions), IBM ENI 7.0, IBM ENI 7.0.1, IBM ENI 7.0.2, IBM Engineering Lifecycle Management 7.0, IBM Engineering Workflow Management 7.0.0, IBM Engineering Workflow Management 7.0.1, IBM Engineering Workflow Management 7.0.2, IBM Rational Engineering Lifecycle Manager 6.0.2, IBM Rational Engineering Lifecycle Manager 6.0.6, IBM Rational Engineering Lifecycle Manager 6.0.6.1, IBM Rational Team Concert 6.0.6, IBM Rational Team Concert 6.0.6.1, IBM Rational Team Concert 6.0.6.2.

• What is the vulnerability in IBM Engineering Lifecycle Optimization - Engineering Insights?

  The vulnerability in IBM Engineering Lifecycle Optimization - Engineering Insights is a cross-site scripting vulnerability that allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

• How can I fix CVE-2021-20520?

  IBM has released patches and fixes for the affected products listed in the answer to the previous question. It is recommended to update to the latest version to mitigate the vulnerability.