CVE-2007-4592

Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/29467	Vendor Advisory
http://securityreason.com/securityalert/3753
http://www.securityfocus.com/archive/1/489861/100/0/threaded
http://www.securityfocus.com/bid/28296
http://www.securitytracker.com/id?1019685
http://www.vupen.com/english/advisories/2008/0952/references	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41328

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:rational_clearquest::::::::
	cpe:2.3:a:ibm:rational_clearquest:7.0.1:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.0.1.1:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.0.2:::::::*

History

No history.

Information

Published : 2008-03-20 00:44

Updated : 2024-02-28 11:21

NVD link : CVE-2007-4592

Mitre link : CVE-2007-4592

CVE.ORG link : CVE-2007-4592

JSON object : View

Products Affected

ibm

rational_clearquest

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2007-4592", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-03-20T00:44:00.000", "references": [{"url": "http://secunia.com/advisories/29467", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3753", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/489861/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/28296", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1019685", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/0952/references", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41328", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en la interfaz web para IBM Rational ClearQuest versiones anteriores a 2003.06.16 Parche 2008A, 7.0.0.2_iFix01 y 7.0.1.1_iFix01, permiten a los atacantes remotos inyectar script web o HTML arbitrario por medio de los par\u00e1metros (1) contextid , (2) username, (3) userNameVal y (4) schema en el componente login."}], "lastModified": "2018-10-15T21:36:39.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:rational_clearquest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF2B2BA7-86BA-45E5-B6D2-D279D6A3C873", "versionEndIncluding": "2003-06-16"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EBBBF4D-97FD-4DBC-B296-4235BAD38F61"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00E3D80A-849E-4739-8905-373AE0C0189D"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEB65A10-EE74-43DF-8D05-B39551F57D2C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}