IBM Rational Asset Manager Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	50556
Class:	Input Validation Error
CVE:	CVE-2011-4708
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Dec 13 2011 06:28PM
Credit:	IBM
Vulnerable:	IBM Rational Asset Manager 7.5
Not Vulnerable:	IBM Rational Asset Manager 7.5.1

IBM Rational Asset Manager Unspecified Cross Site Scripting Vulnerability

IBM Rational Asset Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize unspecified user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials.

Rational Asset Manager 7.5 is vulnerable; other versions may also be affected.

IBM Rational Asset Manager Unspecified Cross Site Scripting Vulnerability

To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user to follow a malicious URI.

IBM Rational Asset Manager Unspecified Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

IBM Rational Asset Manager Unspecified Cross Site Scripting Vulnerability

References:

• PM38467: DFT Reflected XSS security vulnerability found in RAM server (IBM)
  
• Rational Asset Manager Homepage (IBM)