Security Bulletin: Vulnerability in Rational Team Concert with potential for Cross-Site Scripting attack (CVE-2015-0122, CVE-2015-0123)

Summary

An undisclosed security vulnerability of IBM Rational Team Concert may result in Cross-Site Scripting attack.

Vulnerability Details

CVEID: CVE-2015-0123

Description: IBM Rational Team Concert is vulnerable to stored cross-site scripting, caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie based authentication credentials.

CVSS Base Score: 3.5 **CVSS Temporal Score: **See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100421&gt; for the current score *CVSS Environmental Score:**Undefined **CVSS Vector: **(AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVEID: CVE-2015-0122

Description: IBM Rational Team Concert is vulnerable to stored cross-site scripting, caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie based authentication credentials.

CVSS Base Score: 3.5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/100420&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Affected Products and Versions

Rational Team Concert 2.0 - 2.0.0.2
Rational Team Concert 3.0 - 3.0.6
Rational Team Concert 4.0 - 4.0.7
Rational Team Concert 5.0 - 5.0.1

Remediation/Fixes

For the 5.x releases, upgrade to version 5.0.2 or later

• Rational Team Concert 5.0.2

For the 4.x releases, upgrade to version 4.0.7 iFix3 or later

• Rational Team Concert 4.0.7 iFix3

For the 3.x releases upgrade to version 3.0.1.6 iFix 5 or later

• Rational Team Concert 3.0.1.6 iFix5

For the 2.x releases, contact IBM support for additional details on the fix.

Workarounds and Mitigations

None