CVE-2016-2926

MEDIUM

IBM Rational Team Concert 4.0-4.0.7, 5.0-5.0.2, 6.0-6.0.2 Authenticated XSS via Crafted URL

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Team Concert 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94146

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037279

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037277

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037278

Patch, Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21993444

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037276

Scores

CVSS v3 5.4

EPSS 0.0118

EPSS Percentile 64.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (50)

ibm/rational_collaborative_lifecycle_management 3.0.1.6

ibm/rational_collaborative_lifecycle_management 4.0.0

ibm/rational_collaborative_lifecycle_management 4.0.1

ibm/rational_collaborative_lifecycle_management 4.0.2

ibm/rational_collaborative_lifecycle_management 4.0.3

ibm/rational_collaborative_lifecycle_management 4.0.4

ibm/rational_collaborative_lifecycle_management 4.0.5

ibm/rational_collaborative_lifecycle_management 4.0.6

ibm/rational_collaborative_lifecycle_management 4.0.7

ibm/rational_collaborative_lifecycle_management 5.0.0

... and 40 more

Published Nov 25, 2016

Tracked Since Feb 18, 2026