Information disclosure in IBM Rational Collaborative Lifecycle Management
CVE-2015-0113
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Engineering Lifecycle Manager 4.0.3 through 4.0.7 and 5.0 through 5.0.2, Rational Rhapsody Design Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, and Rational Software Architect Design Manager 4.0 through 4.0.7 and 5.0 through 5.0.2 allows remote attackers to read JSP source code via a crafted request.
Vulnerability class: Information Disclosure
EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.
Affected products
- Ibm Rational_collaborative_lifecycle_management — versions 4.0.0, 4.0.1, 4.0.2
- Ibm Rational_doors_next_generation — versions 4.0.0, 4.0.1, 4.0.2
- Ibm Rational_engineering_lifecycle_manager — versions 4.0.3, 4.0.4, 4.0.5
- Ibm Rational_quality_manager — versions 4.0, 4.0.0.1, 4.0.0.2
- Ibm Rational_requirements_composer — versions 4.0.0, 4.0.0.1, 4.0.0.2
- Ibm Rational_rhapsody_design_manager — versions 4.0, 4.0.1, 4.0.2
- Ibm Rational_software_architect_design_manager — versions 4.0.0, 4.0.1, 4.0.2
- Ibm Rational_team_concert — versions 4.0, 4.0.0.1, 4.0.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)