Auth bypass in Ibm Rational Clearcase

CVE-2014-3106

IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not properly implement the Local Access Only protection mechanism, which allows remote attackers to bypass authentication and read files via the Help Server Administration feature.

Vulnerability class: Broken Authentication

EPSS: 0.018 (76.9th percentile) — read the EPSS interpretation.

Affected products

Ibm Rational_clearcase — versions 7.1, 7.1.0.1, 7.1.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
psirt@us.ibm.com (vdb-entry, x_refsource_XF)