IBM Rational ClearCase Cross Site Scripting Vulnerability

Bugtraq ID:	32574
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 01 2008 12:00AM
Updated:	Dec 03 2008 05:12PM
Credit:	IBM
Vulnerable:	IBM ClearCase 7.0 IBM ClearCase 8.0
Not Vulnerable:	IBM ClearCase 7.0.1.3 IBM ClearCase 7.0.0.4

IBM Rational ClearCase Cross Site Scripting Vulnerability

IBM Rational ClearCase is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects versions prior to Rational ClearCase 7.0.0.4 and 7.0.1.3.

IBM Rational ClearCase Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

The following example URI is available:

http://www.example.com/ccrc/??''??script?alert(1234)?/script?=123

IBM Rational ClearCase Cross Site Scripting Vulnerability

Solution:
The vendor released fixes to address this issue. Please see the references for more information.

IBM Rational ClearCase Cross Site Scripting Vulnerability

References:

• Rational ClearCase Homepage (IBM)
  
• PK70972: CROSS-SITE SCRIPTING VULNERABILITIES WITHIN CLEARCASE RWP SERVER (IBM)