CVE-2018-1760

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 61.16%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Rational Collaborative Lifecycle Management IBM Rational Doors Next Generation IBM Rational Engineering Lifecycle Manager +5 more

Timeline

PublishedJun 27

Latest updateMay 24

Description

IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148614.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages9 packages

▶NVDibm/rational_collaborative_lifecycle_management6.0 — 6.0.6.1

▶CVEListV5ibm/rational_collaborative_lifecycle_management8 versions+7

▶NVDibm/rational_engineering_lifecycle_manager6.0 — 6.0.6.1

▶NVDibm/rational_team_concert6.0 — 6.0.6.1

▶NVDibm/rational_quality_manager6.0 — 6.0.6.1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-445v-c445-j3w2: IBM Rational Collaborative Lifecycle Management 6↗2022-05-24

▶

CVEList

CVE-2018-1760: IBM Rational Collaborative Lifecycle Management 6↗2019-06-27

▶