CVE-2018-1585 — Cross-site Scripting in IBM Rational Rhapsody Design Manager

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 63.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Rational Rhapsody Design ManagerIBM Rational Software Architect Design Manager
Timeline
PublishedJul 19
Latest updateMay 13

Description

IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143498.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5ibm/rational_rhapsody_design_manager9 versions+8

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qfgh-2cg8-38hg: IBM Rational Rhapsody Design Manager 5↗2022-05-13
▶
CVEList
CVE-2018-1585: IBM Rational Rhapsody Design Manager 5↗2018-07-19
▶
CVE-2018-1585 — Cross-site Scripting in IBM | cvebase