Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to Clickjacking when X-Frame-Options, Content-Security-Policy headers are not included in the HTTP response.(CVE-2021-29865)

Summary Summary guidance: - The Jazz Team Server is vulnerable to Clickjacking. Vulnerability Details CVEID: CVE-2021-29865 DESCRIPTION: IBM Jazz Foundation could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote...

CVE-2021-29865

The CVE-2021-29865 issue affects IBM Jazz Team Server versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2, where lack of proper HTTP headers (X-Frame-Options / Content-Security-Policy) enables clickjacking, allowing a remote attacker to hijack a user’s click actions by convincing the victim to visit a...