Lucene search

[email protected]CVE-2014-8925

HistoryMar 25, 2015 - 1:59 a.m.

CVE-2014-8925

2015-03-2501:59:12

CWE-352

[email protected]

web.nvd.nist.gov

clearquest

web

csrf

vulnerability

authentication

hijacking

logout

xss

nvd

ibm rational clearquest

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.1%

JSON

Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences.

Affected configurations

NVD

Node

ibmrational_clearquestMatch7.1

ibmrational_clearquestMatch7.1.0.1

ibmrational_clearquestMatch7.1.0.2

ibmrational_clearquestMatch7.1.1

ibmrational_clearquestMatch7.1.1.1

ibmrational_clearquestMatch7.1.1.2

ibmrational_clearquestMatch7.1.1.3

ibmrational_clearquestMatch7.1.1.4

ibmrational_clearquestMatch7.1.1.5

ibmrational_clearquestMatch7.1.1.6

ibmrational_clearquestMatch7.1.1.7

ibmrational_clearquestMatch7.1.1.8

ibmrational_clearquestMatch7.1.1.9

ibmrational_clearquestMatch7.1.2

ibmrational_clearquestMatch7.1.2.1

ibmrational_clearquestMatch7.1.2.2

ibmrational_clearquestMatch7.1.2.3

ibmrational_clearquestMatch7.1.2.4

ibmrational_clearquestMatch7.1.2.5

ibmrational_clearquestMatch7.1.2.6

ibmrational_clearquestMatch7.1.2.7

ibmrational_clearquestMatch7.1.2.8

ibmrational_clearquestMatch7.1.2.9

ibmrational_clearquestMatch7.1.2.10

ibmrational_clearquestMatch7.1.2.11

ibmrational_clearquestMatch7.1.2.12

ibmrational_clearquestMatch7.1.2.13

ibmrational_clearquestMatch7.1.2.14

ibmrational_clearquestMatch7.1.2.15

ibmrational_clearquestMatch8.0.0

ibmrational_clearquestMatch8.0.0.1

ibmrational_clearquestMatch8.0.0.2

ibmrational_clearquestMatch8.0.0.3

ibmrational_clearquestMatch8.0.0.4

ibmrational_clearquestMatch8.0.0.5

ibmrational_clearquestMatch8.0.0.6

ibmrational_clearquestMatch8.0.0.7

ibmrational_clearquestMatch8.0.0.8

ibmrational_clearquestMatch8.0.0.9

ibmrational_clearquestMatch8.0.0.10

ibmrational_clearquestMatch8.0.0.11

ibmrational_clearquestMatch8.0.0.12

ibmrational_clearquestMatch8.0.1

ibmrational_clearquestMatch8.0.1.1

ibmrational_clearquestMatch8.0.1.2

ibmrational_clearquestMatch8.0.1.3

ibmrational_clearquestMatch8.0.1.4

ibmrational_clearquestMatch8.0.1.5

CPENameOperatorVersion
ibm:rational_clearquestibm rational clearquesteq7.1
ibm:rational_clearquestibm rational clearquesteq7.1.0.1
ibm:rational_clearquestibm rational clearquesteq7.1.0.2
ibm:rational_clearquestibm rational clearquesteq7.1.1
ibm:rational_clearquestibm rational clearquesteq7.1.1.1
ibm:rational_clearquestibm rational clearquesteq7.1.1.2
ibm:rational_clearquestibm rational clearquesteq7.1.1.3
ibm:rational_clearquestibm rational clearquesteq7.1.1.4
ibm:rational_clearquestibm rational clearquesteq7.1.1.5
ibm:rational_clearquestibm rational clearquesteq7.1.1.6

CPE	Name	Operator	Version
ibm:rational_clearquest	ibm rational clearquest	eq	7.1
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.0.1
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.0.2
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1.1
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1.2
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1.3
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1.4
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1.5
ibm:rational_clearquest	ibm rational clearquest	eq	7.1.1.6