CVE-2016-2926
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0…
Does this matter?
Lower severity and a low EPSS score (1.18%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Team Concert 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
- CVSS 3.0
- 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ibm/rational team concert · ibm/rational rhapsody design manager · ibm/rational engineering lifecycle manager · ibm/rational quality manager · ibm/rational collaborative lifecycle management · ibm/rational software architect design manager · ibm/rational doors next generation
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21993444Patch, Vendor Advisory
- http://www.securityfocus.com/bid/94146
- http://www.securitytracker.com/id/1037276
- http://www.securitytracker.com/id/1037277
- http://www.securitytracker.com/id/1037278
- http://www.securitytracker.com/id/1037279
- http://www-01.ibm.com/support/docview.wss?uid=swg21993444Patch, Vendor Advisory
- http://www.securityfocus.com/bid/94146
- http://www.securitytracker.com/id/1037276
- http://www.securitytracker.com/id/1037277
- http://www.securitytracker.com/id/1037278
- http://www.securitytracker.com/id/1037279
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.