CVE-2007-4592

2008-03-2000:44:00

CWE-79

[email protected]

web.nvd.nist.gov

ibm

rational clearquest

xss

vulnerabilities

web interface

security

nvd

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

72.0%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component.

CPENameOperatorVersion
ibm:rational_clearquestibm rational clearquesteq7.0.1.1
ibm:rational_clearquestibm rational clearquestle2003-06-16
ibm:rational_clearquestibm rational clearquesteq7.0.1
ibm:rational_clearquestibm rational clearquesteq7.0.2

CPE	Name	Operator	Version
ibm:rational_clearquest	ibm rational clearquest	eq	7.0.1.1
ibm:rational_clearquest	ibm rational clearquest	le	2003-06-16
ibm:rational_clearquest	ibm rational clearquest	eq	7.0.1
ibm:rational_clearquest	ibm rational clearquest	eq	7.0.2