Information disclosure in IBM Rational Clearquest

CVE-2008-3550

The CQWeb login page in IBM Rational ClearQuest 7.0.1 allows remote attackers to obtain potentially sensitive information (page source code) via a combination of ?script? and ?/script? sequences in the id field, possibly related to a cross-site scripting (XSS) vulnerability.

Vulnerability class: Information Disclosure

EPSS: 0.012 (65.0th percentile) — read the EPSS interpretation.

Affected products

Ibm Rational_clearquest — versions 7.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (vendor-advisory, x_refsource_AIXAPAR)
cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (vdb-entry, x_refsource_VUPEN)