IBM Rational DOORS Next Generation Multiple Cross Site Scripting Vulnerabilities
BID:107771
CVE-2018-1731 | CVE-2018-1913 |Info
IBM Rational DOORS Next Generation Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 107771 |
| Class: | Input Validation Error |
| CVE: |
CVE-2018-1731 CVE-2018-1913 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 01 2019 12:00AM |
| Updated: | Apr 01 2019 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Rational DOORS Next Generation 6.0.4 IBM Rational DOORS Next Generation 6.0.3 IBM Rational DOORS Next Generation 6.0.2 IBM Rational DOORS Next Generation 6.0.1 IBM Rational DOORS Next Generation 5.0.2 IBM Rational DOORS Next Generation 5.0.1 IBM Rational DOORS Next Generation 6.0.6 IBM Rational DOORS Next Generation 6.0.5 IBM Rational DOORS Next Generation 6.0 IBM Rational DOORS Next Generation 5.0 |
| Not Vulnerable: |
IBM Rational DOORS Next Generation 6.0.5 iFix010 IBM Rational DOORS Next Generation 6.0.6 iFix005 IBM Rational DOORS Next Generation 6.0.4 iFix012 IBM Rational DOORS Next Generation 6.0.2 iFix019 IBM Rational DOORS Next Generation 5.0.2 iFix029 |
Discussion
IBM Rational DOORS Next Generation Multiple Cross Site Scripting Vulnerabilities
IBM Rational DOORS Next Generation is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are vulnerable:
Rational DOORS Next Generation 5.0 through 5.0.2
Rational DOORS Next Generation 6.0 through 6.0.6
IBM Rational DOORS Next Generation is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are vulnerable:
Rational DOORS Next Generation 5.0 through 5.0.2
Rational DOORS Next Generation 6.0 through 6.0.6
Exploit / POC
IBM Rational DOORS Next Generation Multiple Cross Site Scripting Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
IBM Rational DOORS Next Generation Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Rational DOORS Next Generation Multiple Cross Site Scripting Vulnerabilities
References:
References: