CVE-2016-3014
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Quality Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Team Concert 4.0…
Does this matter?
Lower severity and a low EPSS score (1.32%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Quality Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Team Concert 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational DOORS Next Generation 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- CVSS 3.0
- 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ibm/rational engineering lifecycle manager · ibm/rational rhapsody design manager · ibm/rational quality manager · ibm/rational software architect design manager · ibm/rational doors next generation · ibm/rational team concert · ibm/rational collaborative lifecycle management
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21992151Vendor Advisory
- http://www.securityfocus.com/bid/93515Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037025
- http://www.securitytracker.com/id/1037026
- http://www.securitytracker.com/id/1037027
- http://www.securitytracker.com/id/1037028
- http://www-01.ibm.com/support/docview.wss?uid=swg21992151Vendor Advisory
- http://www.securityfocus.com/bid/93515Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037025
- http://www.securitytracker.com/id/1037026
- http://www.securitytracker.com/id/1037027
- http://www.securitytracker.com/id/1037028
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.