CVE-2015-0123

IBM Rational Team Concert < 3.0.1.6 iFix 5, < 4.0.7 iFix3, < 5.0.2 - Authenticated XSS via Crafted URL

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122.

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21698253

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1031884

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/73101

Scores

EPSS 0.0140

EPSS Percentile 69.7%

Details

CWE

CWE-79

Status published

Products (21)

ibm/rational_team_concert 2.0.0.2

ibm/rational_team_concert 3.0

ibm/rational_team_concert 3.0.1

ibm/rational_team_concert 3.0.1.1

ibm/rational_team_concert 3.0.1.2

ibm/rational_team_concert 3.0.1.3

ibm/rational_team_concert 3.0.1.4

ibm/rational_team_concert 3.0.1.5

ibm/rational_team_concert 3.0.1.6

ibm/rational_team_concert 4.0

... and 11 more

Published Mar 13, 2015

Tracked Since Feb 18, 2026