CVE-2017-1127

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 57.88%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Corporation Rational Doors Next Generation IBM Rational Doors Next Generation IBM Rational Requirements Composer

Timeline

PublishedFeb 8

Latest updateMay 17

Description

IBM Rational DOORS Next Generation 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDibm/rational_doors_next_generation8 versions+7

▶CVEListV5ibm_corporation/rational_doors_next_generation13 versions+12

▶NVDibm/rational_requirements_composer11 versions+10

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-7fxf-842w-jmjm: IBM Rational DOORS Next Generation 4↗2022-05-17

▶

CVEList

CVE-2017-1127: IBM Rational DOORS Next Generation 4↗2017-02-08

▶

💥Exploits & PoCs

Exploit-DB

Microsoft Windows 7 Kernel - Pool-Based Out-of-Bounds Reads Due to bind() Implementation Bugs in afd.sys / tcpip.sys↗2017-05-15

▶