IBM Rational Team Concert 'Report Name' Field HTML Injection Vulnerability
BID:46179
Info
IBM Rational Team Concert 'Report Name' Field HTML Injection Vulnerability
| Bugtraq ID: | 46179 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-1029 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2011 12:00AM |
| Updated: | Mar 19 2015 07:35AM |
| Credit: | IBM |
| Vulnerable: |
IBM Rational Team Concert 2.0 |
| Not Vulnerable: | |
Discussion
IBM Rational Team Concert 'Report Name' Field HTML Injection Vulnerability
IBM Rational Team Concert is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
An authenticated attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
IBM Rational Team Concert is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
An authenticated attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
IBM Rational Team Concert 'Report Name' Field HTML Injection Vulnerability
Attackers can exploit this issue with a browser.
Attackers can exploit this issue with a browser.
Solution / Fix
IBM Rational Team Concert 'Report Name' Field HTML Injection Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Solution:
The vendor has released an advisory and updates. Please see the references for details.
References
IBM Rational Team Concert 'Report Name' Field HTML Injection Vulnerability
References:
References: