CVE-2017-1602 — Files or Directories Accessible to External Parties in IBM Rational Collaborative Lifecycle Management

CWE-552 — Files or Directories Accessible to External Parties3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

0.2%

top 62.42%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Rational Collaborative Lifecycle Management IBM Rational Doors Next Generation IBM Rational Engineering Lifecycle Manager +4 more

Timeline

PublishedMar 23

Latest updateMay 13

Description

IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages8 packages

▶NVDibm/rational_collaborative_lifecycle_management4.0.0 — 6.0.5

▶CVEListV5ibm/rational_collaborative_lifecycle_management9 versions+8

▶NVDibm/rational_engineering_lifecycle_manager4.0.3 — 4.0.7+4

▶NVDibm/rational_team_concert4.0.0 — 4.0.7+4

▶NVDibm/rational_quality_manager4.0.0 — 4.0.7+4

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-mjm8-h7pj-pxm5: IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5↗2022-05-13

▶

CVEList

CVE-2017-1602: IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5↗2018-03-23

▶