CSRF in IBM Rational Engineering Lifecycle Manager
CVE-2014-3037
Cross-site request forgery (CSRF) vulnerability in IBM Configuration Management Application (aka VVC) in IBM Rational Engineering Lifecycle Manager before 4.0.7 and 5.x before 5.0.1, Rational Software Architect Design Manager before 4.0.7 and 5.x before 5.0.1, and Rational Rhapsody Design Manager before 4.0.7 and 5.x before 5.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.008 (52.3th percentile) — read the EPSS interpretation.
Affected products
- Ibm Rational_engineering_lifecycle_manager — versions 1.0, 1.0.0.1, 4.03
- Ibm Rational_rhapsody_design_manager — versions 3.0, 3.0.0.1, 3.0.1
- Ibm Rational_software_architect_design_manager — versions 3.0, 3.0.0.1, 4.0.0
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (vdb-entry, x_refsource_BID)
- psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- psirt@us.ibm.com (x_refsource_SECUNIA, third-party-advisory)
- psirt@us.ibm.com (x_refsource_SECUNIA, third-party-advisory)