IBM Rational ClearQuest SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	56946
Class:	Input Validation Error
CVE:	CVE-2012-4839 CVE-2012-5765
Remote:	Yes
Local:	No
Published:	Dec 12 2012 12:00AM
Updated:	Dec 12 2012 12:00AM
Credit:	Reported by the vendor
Vulnerable:	IBM Rational ClearQuest 8.0.1 IBM Rational ClearQuest 8.0.0.4 IBM Rational ClearQuest 8.0.0.3 IBM Rational ClearQuest 7.1.2.7 IBM Rational ClearQuest 7.1.2.5 IBM IBM Rational ClearQuest 8.0.0.2 IBM IBM Rational ClearQuest 8.0.0.1 IBM IBM Rational ClearQuest 7.1.2.6
Not Vulnerable:	IBM Rational ClearQuest 8.0.0.5 IBM Rational ClearQuest 7.1.1.3

IBM Rational ClearQuest SQL Injection and Cross Site Scripting Vulnerabilities

IBM Rational ClearQuest is prone to cross-site scripting and SQL-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

IBM Rational ClearQuest versions prior to 7.1.2.9 and 8.0.0.5 are vulnerable.

IBM Rational ClearQuest SQL Injection and Cross Site Scripting Vulnerabilities

References:

• IBM Rational ClearQuest HomePage (IBM)
  
• Security Bulletin: ClearQuest Phishing Through Frames Vulnerability (CVE-2012-48 (IBM)
  
• Security Bulletin: ClearQuest SQL Error Message Attack Vulnerability (CVE-2012-5 (IBM)