CVE-2014-3037

IBM Rational Rhapsody Design Manager < 4.0.7 and 5.x < 5.0.1 - Authenticated Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in IBM Configuration Management Application (aka VVC) in IBM Rational Engineering Lifecycle Manager before 4.0.7 and 5.x before 5.0.1, Rational Software Architect Design Manager before 4.0.7 and 5.x before 5.0.1, and Rational Rhapsody Design Manager before 4.0.7 and 5.x before 5.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/93303
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69658
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682120
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61071
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60649

Scores

EPSS 0.0078
EPSS Percentile 51.6%

Details

CWE
CWE-352
Status published
Products (28)
ibm/rational_engineering_lifecycle_manager 1.0
ibm/rational_engineering_lifecycle_manager 1.0.0.1
ibm/rational_engineering_lifecycle_manager 4.03
ibm/rational_engineering_lifecycle_manager 4.04
ibm/rational_engineering_lifecycle_manager 4.05
ibm/rational_engineering_lifecycle_manager 5.0
ibm/rational_engineering_lifecycle_manager < 4.06
ibm/rational_rhapsody_design_manager 3.0
ibm/rational_rhapsody_design_manager 3.0.0.1
ibm/rational_rhapsody_design_manager 3.0.1
... and 18 more
Published Sep 10, 2014
Tracked Since Feb 18, 2026