Security Bulletin: ClearQuest Cross-Site Scripting (XSS) Vulnerability (CVE-2012-5757)

Summary

IBM Rational ClearQuest Web client contains a Cross-Site Scripting vulnerability.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID: CVE-2012-5757

Description: The ClearQuest Web client contains a Cross-Site Scripting vulnerability. This vulnerability does not exist in the ClearQuest desktop clients or command line utilities.

**CVSS Base Score:**4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/80061&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

ClearQuest Web Clients prior to version 7.1.2.10 or version 8.0.0.6.

Remediation/Fixes

Upgrade to one of the following:

• Rational ClearQuest Fix Pack 6 (8.0.0.6) for 8.0
• Rational ClearQuest Fix Pack 10 (7.1.2.10) for 7.1.2

Workarounds and Mitigations

Use ClearQuest desktop applications.