Multiple IBM Rational Products Cross Site Scripting and HTTP Header Injection Vulnerabilities

Bugtraq ID:	107435
Class:	Input Validation Error
CVE:	CVE-2018-1658 CVE-2018-1688 CVE-2018-1916 CVE-2018-1952
Remote:	Yes
Local:	No
Published:	Mar 08 2019 12:00AM
Updated:	Mar 08 2019 12:00AM
Credit:	IBM
Vulnerable:	IBM Rational Team Concert 6.0.4 IBM Rational Team Concert 6.0.3 IBM Rational Team Concert 6.0.2 IBM Rational Team Concert 6.0.1 IBM Rational Team Concert 5.0.1 IBM Rational Team Concert 6.0.6 IBM Rational Team Concert 6.0.5 IBM Rational Team Concert 6.0 IBM Rational Team Concert 5.0.2 IBM Rational Team Concert 5.0 IBM Rational Software Architect Design Manager 6.0.1 IBM Rational Software Architect Design Manager 5.0.2 IBM Rational Software Architect Design Manager 5.0.1 IBM Rational Software Architect Design Manager 6.0 IBM Rational Software Architect Design Manager 5.0 IBM Rational Rhapsody Design Manager 6.0.4 IBM Rational Rhapsody Design Manager 6.0.3 IBM Rational Rhapsody Design Manager 6.0.2 IBM Rational Rhapsody Design Manager 6.0.1 IBM Rational Rhapsody Design Manager 5.0.2 IBM Rational Rhapsody Design Manager 5.0.1 IBM Rational Rhapsody Design Manager 6.0.6 IBM Rational Rhapsody Design Manager 6.0.5 IBM Rational Rhapsody Design Manager 6.0 IBM Rational Rhapsody Design Manager 5.0 IBM Rational Quality Manager 6.0.2 IBM Rational Quality Manager 6.0.1 IBM Rational Quality Manager 5.0.1 IBM Rational Quality Manager 6.0.6 IBM Rational Quality Manager 6.0.5 IBM Rational Quality Manager 6.0.4 IBM Rational Quality Manager 6.0.3 IBM Rational Quality Manager 6.0 IBM Rational Quality Manager 5.0.2 IBM Rational Quality Manager 5.0 IBM Rational Engineering Lifecycle Manager 6.0.3 IBM Rational Engineering Lifecycle Manager 6.0.2 IBM Rational Engineering Lifecycle Manager 6.0.1 IBM Rational Engineering Lifecycle Manager 5.0.2 IBM Rational Engineering Lifecycle Manager 5.0.1 IBM Rational Engineering Lifecycle Manager 6.0.6 IBM Rational Engineering Lifecycle Manager 6.0.5 IBM Rational Engineering Lifecycle Manager 6.0.4 IBM Rational Engineering Lifecycle Manager 6.0 IBM Rational Engineering Lifecycle Manager 5.0 IBM Rational Collaborative Lifecycle Management 6.0.4 IBM Rational Collaborative Lifecycle Management 6.0.3 IBM Rational Collaborative Lifecycle Management 6.0.2 IBM Rational Collaborative Lifecycle Management 6.0.1 IBM Rational Collaborative Lifecycle Management 5.0.7 IBM Rational Collaborative Lifecycle Management 5.0.1 IBM Rational Collaborative Lifecycle Management 6.0.6 IBM Rational Collaborative Lifecycle Management 6.0.5 IBM Rational Collaborative Lifecycle Management 6.0 IBM Rational Collaborative Lifecycle Management 5.0.0
Not Vulnerable:	IBM Rational Team Concert 6.0.6 iFix007 IBM Rational Team Concert 6.0.2 iFix020 IBM Rational Team Concert 5.0.2 iFix029 IBM Rational Software Architect Design Manager 6.0.6 iFix007 IBM Rational Software Architect Design Manager 5.0.2 iFix029 IBM Rational Software Architect Design Manager 6.0.2 iFix020 IBM Rational Rhapsody Design Manager 6.0.6 iFix007 IBM Rational Rhapsody Design Manager 6.0.2 iFix020 IBM Rational Rhapsody Design Manager 5.0.2 iFix029 IBM Rational Quality Manager 6.0.6 iFix007 IBM Rational Quality Manager 6.0.2 iFix020 IBM Rational Quality Manager 5.0.2 iFix029 IBM Rational Engineering Lifecycle Manager 6.0.2 iFix20 IBM Rational Engineering Lifecycle Manager 6.0.6 iFix007 IBM Rational Engineering Lifecycle Manager 5.0.2 iFix029 IBM Rational DOORS Next Generation 6.0.6 iFix007 IBM Rational DOORS Next Generation 6.0.2 iFix020 IBM Rational DOORS Next Generation 5.0.2 iFix029 IBM Rational Collaborative Lifecycle Management 6.0.6 iFix007 IBM Rational Collaborative Lifecycle Management 5.0.2 iFix029

Multiple IBM Rational Products Cross Site Scripting and HTTP Header Injection Vulnerabilities

IBM Rational Products are prone to a cross-site scripting vulnerability and an HTTP header-injection vulnerability.

An attacker may leverage these issues to insert a crafted HTTP header into an HTTP response that could cause web server cache poisoning, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following products and versions are affected:

Rational Collaborative Lifecycle Management 5.0 through 6.0.6

Rational Quality Manager 5.0 through 5.0.2
Rational Quality Manager 6.0 through 6.0.6

Rational Team Concert 5.0 through 5.0.2
Rational Team Concert 6.0 through 6.0.6

Rational DOORS Next Generation 5.0 through 5.0.2
Rational DOORS Next Generation 6.0 through 6.0.6

Rational Engineering Lifecycle Manager 5.0 through 5.0.2
Rational Engineering Lifecycle Manager 6.0 through 6.0.6

Rational Rhapsody Design Manager 5.0 through 5.0.2
Rational Rhapsody Design Manager 6.0 through 6.0.6

Rational Software Architect Design Manager 5.0 through 5.0.2
Rational Software Architect Design Manager 6.0 through 6.0.1

Multiple IBM Rational Products Cross Site Scripting and HTTP Header Injection Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user into visiting a specially crafted URL.

Multiple IBM Rational Products Cross Site Scripting and HTTP Header Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple IBM Rational Products Cross Site Scripting and HTTP Header Injection Vulnerabilities

References:

• IBM Home Page (IBM)
  
• Security Bulletin: Security vulnerabilities affect multiple IBM Rational produc (IBM)