IBM Rational ClearQuest View Record Browser Bookmark Information Disclosure Vulnerability

Bugtraq ID:	45646
Class:	Design Error
CVE:	CVE-2010-4602
Remote:	Yes
Local:	Yes
Published:	Jan 03 2011 12:00AM
Updated:	Jan 03 2011 12:00AM
Credit:	IBM
Vulnerable:	IBM Rational ClearQuest 7.1.1 02 IBM Rational ClearQuest 7.1.1 IBM Rational ClearQuest 7.1 2 IBM Rational ClearQuest 7.0.1 3 IBM Rational ClearQuest 7.0.1 .1 IBM Rational ClearQuest 7.0.1 IBM Rational ClearQuest 7.0 4 IBM Rational ClearQuest 7.0 .2 IBM Rational ClearQuest 7.0 .1 IBM Rational ClearQuest 7.1.2 IBM Rational ClearQuest 7.1 IBM Rational ClearQuest 7.0.1.5 IBM Rational ClearQuest 7.0.1.4 IBM Rational ClearQuest 7.0.0.6 IBM Rational ClearQuest 7.0.0.5 IBM Rational ClearQuest 7.0 IBM Rational ClearQuest
Not Vulnerable:	IBM Rational ClearQuest 7.1.2.1 IBM Rational ClearQuest 7.1.1.4

IBM Rational ClearQuest View Record Browser Bookmark Information Disclosure Vulnerability

IBM Rational ClearQuest is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information, that may lead to further attacks.

Versions prior to IBM Rational ClearQuest 7.1.1.4, and 7.1.2.1 are vulnerable.

IBM Rational ClearQuest View Record Browser Bookmark Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Rational ClearQuest View Record Browser Bookmark Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for more information.

IBM Rational ClearQuest View Record Browser Bookmark Information Disclosure Vulnerability

References:

• Rational ClearQuest Homepage (IBM)
  
• PM20172: restricted user can view any record via the browser bookmark (IBM)