XSS in IBM Rational Quality Manager
CVE-2013-5404
Cross-site scripting (XSS) vulnerability in the search implementation in IBM Rational Quality Manager (RQM) 2.0 through 2.0.1.1, 3.x before 3.0.1.6 iFix 1, and 4.x before 4.0.5, as used in Rational Team Concert, Rational Requirements Composer, and other products, allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IFRAME element.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (51.5th percentile) — read the EPSS interpretation.
Affected products
- Ibm Rational_quality_manager — versions 2.0, 2.0.0.1, 2.0.0.2
- Ibm Rational_requirements_composer — versions 2.0, 2.0.0.1, 2.0.0.2
- Ibm Rational_team_concert — versions 2.0, 2.0.0.1, 2.0.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)