Security Bulletin: IBM Engineering Test Management is vulnerable to execute arbitrary commands on system due to XStream ( CVE-2021-29505 ).

Summary

IBM Engineering Test Management is vulnerable to remote attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

Vulnerability Details

CVEID:CVE-2021-29505
**DESCRIPTION:**XStream XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202795 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to following IBM Engineering Test Management releases or any version later :

• IBM Engineering Test Management 7.0.2 iFix008
• IBM Engineering Test Management 7.0.1 iFix012
• IBM Engineering Test Management 7.0 iFix013
• Rational Quality Manager 6.0.6.1 iFix020
• Rational Quality Manager 6.0.6 iFix024

Workarounds and Mitigations

None.