IBM Rational ClearQuest Web Multiple Unspecified Cross Site Scripting Vulnerabilities

Bugtraq ID:	32576
Class:	Input Validation Error
CVE:	CVE-2008-5324
Remote:	Yes
Local:	No
Published:	Dec 02 2008 12:00AM
Updated:	Dec 11 2008 05:01AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	IBM Rational ClearQuest 7.0.1 .1 IBM Rational ClearQuest 7.0.1 IBM Rational ClearQuest 7.0 .2 IBM Rational ClearQuest 7.0 .1 IBM Rational ClearQuest 7.0
Not Vulnerable:	IBM Rational ClearQuest 7.0.1 3 IBM Rational ClearQuest 7.0 4

IBM Rational ClearQuest Web Multiple Unspecified Cross Site Scripting Vulnerabilities

IBM Rational ClearQuest Web is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Versions prior to ClearQuest 7.0.0.4 and 7.0.1.3 are vulnerable.

IBM Rational ClearQuest Web Multiple Unspecified Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

IBM Rational ClearQuest Web Multiple Unspecified Cross Site Scripting Vulnerabilities

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

IBM Rational ClearQuest Web Multiple Unspecified Cross Site Scripting Vulnerabilities

References:

• PK69316: CQ Web Cross-site scripting vulnerability (IBM)
  
• Rational ClearQuest Homepage (IBM)