Vulnerability-Lookup

CNVD-2018-23901

Vulnerability from cnvd - Published: 2018-11-23

Title

IBM Rational Rhapsody Design Manager和IBM Rational Software Architect Design Manager跨站脚本漏洞（CNVD-2018-23901）

Description

IBM Rational Rhapsody Design Manager是基于IBM Jazz平台构建的协同设计管理软件，可帮助设计团队成员和利益相关者共享、跟踪、审查及管理设计。IBM Rational Software Architect Design Manager是一个基于Jazz技术的协作软件开发和设计平台。 IBM Rational Rhapsody Design Manager和IBM Rational Software Architect Design Manager存在跨站脚本漏洞。用户可利用该漏洞在Web UI中嵌入任意JavaScript代码，这会改变预期功能，从而会导致受信任会话中的凭据泄露。

Severity

低

Patch Name

IBM Rational Rhapsody Design Manager和IBM Rational Software Architect Design Manager跨站脚本漏洞（CNVD-2018-23901）的补丁

Patch Description

Formal description

厂商已发布漏洞修复程序，请及时关注更新： http://www-01.ibm.com/support/docview.wss?uid=ibm10716029

Reference

http://www-01.ibm.com/support/docview.wss?uid=ibm10716029

Impacted products

Name
IBM Rational Rhapsody Design Manager 5.0 - 5.0.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1535"
    }
  },
  "description": "IBM Rational Rhapsody Design Manager\u662f\u57fa\u4e8eIBM Jazz\u5e73\u53f0\u6784\u5efa\u7684\u534f\u540c\u8bbe\u8ba1\u7ba1\u7406\u8f6f\u4ef6\uff0c\u53ef\u5e2e\u52a9\u8bbe\u8ba1\u56e2\u961f\u6210\u5458\u548c\u5229\u76ca\u76f8\u5173\u8005\u5171\u4eab\u3001\u8ddf\u8e2a\u3001\u5ba1\u67e5\u53ca\u7ba1\u7406\u8bbe\u8ba1\u3002IBM Rational Software Architect Design Manager\u662f\u4e00\u4e2a\u57fa\u4e8eJazz\u6280\u672f\u7684\u534f\u4f5c\u8f6f\u4ef6\u5f00\u53d1\u548c\u8bbe\u8ba1\u5e73\u53f0\u3002\n\nIBM Rational Rhapsody Design Manager\u548cIBM Rational Software Architect Design Manager\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u7528\u6237\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Web UI\u4e2d\u5d4c\u5165\u4efb\u610fJavaScript\u4ee3\u7801\uff0c\u8fd9\u4f1a\u6539\u53d8\u9884\u671f\u529f\u80fd\uff0c\u4ece\u800c\u4f1a\u5bfc\u81f4\u53d7\u4fe1\u4efb\u4f1a\u8bdd\u4e2d\u7684\u51ed\u636e\u6cc4\u9732\u3002",
  "discovererName": "IBM",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=ibm10716029",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-23901",
  "openTime": "2018-11-23",
  "patchDescription": "IBM Rational Rhapsody Design Manager\u662f\u57fa\u4e8eIBM Jazz\u5e73\u53f0\u6784\u5efa\u7684\u534f\u540c\u8bbe\u8ba1\u7ba1\u7406\u8f6f\u4ef6\uff0c\u53ef\u5e2e\u52a9\u8bbe\u8ba1\u56e2\u961f\u6210\u5458\u548c\u5229\u76ca\u76f8\u5173\u8005\u5171\u4eab\u3001\u8ddf\u8e2a\u3001\u5ba1\u67e5\u53ca\u7ba1\u7406\u8bbe\u8ba1\u3002IBM Rational Software Architect Design Manager\u662f\u4e00\u4e2a\u57fa\u4e8eJazz\u6280\u672f\u7684\u534f\u4f5c\u8f6f\u4ef6\u5f00\u53d1\u548c\u8bbe\u8ba1\u5e73\u53f0\u3002\r\n\r\nIBM Rational Rhapsody Design Manager\u548cIBM Rational Software Architect Design Manager\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u7528\u6237\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Web UI\u4e2d\u5d4c\u5165\u4efb\u610fJavaScript\u4ee3\u7801\uff0c\u8fd9\u4f1a\u6539\u53d8\u9884\u671f\u529f\u80fd\uff0c\u4ece\u800c\u4f1a\u5bfc\u81f4\u53d7\u4fe1\u4efb\u4f1a\u8bdd\u4e2d\u7684\u51ed\u636e\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Rational Rhapsody Design Manager\u548cIBM Rational Software Architect Design Manager\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2018-23901\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "IBM Rational Rhapsody Design Manager 5.0 - 5.0.2"
  },
  "referenceLink": "http://www-01.ibm.com/support/docview.wss?uid=ibm10716029",
  "serverity": "\u4f4e",
  "submitTime": "2018-07-20",
  "title": "IBM Rational Rhapsody Design Manager\u548cIBM Rational Software Architect Design Manager\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2018-23901\uff09"
}

CVE-2018-1535 (GCVE-0-2018-1535)

Vulnerability from cvelistv5 – Published: 2018-07-19 14:00 – Updated: 2024-09-16 20:52

Summary

IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124557.

Severity

5.4 (Medium)


                        
                          CVSS:3.0/A:N/AC:L/AV:N/C:L/I:L/PR:L/S:C/UI:R/E:H/RC:C/RL:O

CWE

Cross-Site Scripting

Assigner

ibm

References

2 references

URL	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.ibm.com/support/docview.wss?uid=ibm10716029	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
IBM	Rational Rhapsody Design Manager	Affected: 5.0 Affected: 5.0.2 Affected: 5.0.1 Affected: 6.0 Affected: 6.0.1 Affected: 6.0.2 Affected: 6.0.3 Affected: 6.0.4 Affected: 6.0.5
IBM	Rational Software Architect Design Manager	Affected: 5.0 Affected: 5.0.2 Affected: 5.0.1 Affected: 6.0 Affected: 6.0.1

Date Public

2018-07-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:07:43.378Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ibm-rhapsody-cve20181535-xss(142557)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142557"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=ibm10716029"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Rational Rhapsody Design Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "status": "affected",
              "version": "5.0.2"
            },
            {
              "status": "affected",
              "version": "5.0.1"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.0.1"
            },
            {
              "status": "affected",
              "version": "6.0.2"
            },
            {
              "status": "affected",
              "version": "6.0.3"
            },
            {
              "status": "affected",
              "version": "6.0.4"
            },
            {
              "status": "affected",
              "version": "6.0.5"
            }
          ]
        },
        {
          "product": "Rational Software Architect Design Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "status": "affected",
              "version": "5.0.2"
            },
            {
              "status": "affected",
              "version": "5.0.1"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.0.1"
            }
          ]
        }
      ],
      "datePublic": "2018-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124557."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 5.2,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/A:N/AC:L/AV:N/C:L/I:L/PR:L/S:C/UI:R/E:H/RC:C/RL:O",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-Site Scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-19T13:57:01.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "ibm-rhapsody-cve20181535-xss(142557)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142557"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=ibm10716029"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2018-07-16T00:00:00",
          "ID": "CVE-2018-1535",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Rational Rhapsody Design Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "5.0"
                          },
                          {
                            "version_value": "5.0.2"
                          },
                          {
                            "version_value": "5.0.1"
                          },
                          {
                            "version_value": "6.0"
                          },
                          {
                            "version_value": "6.0.1"
                          },
                          {
                            "version_value": "6.0.2"
                          },
                          {
                            "version_value": "6.0.3"
                          },
                          {
                            "version_value": "6.0.4"
                          },
                          {
                            "version_value": "6.0.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Rational Software Architect Design Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "5.0"
                          },
                          {
                            "version_value": "5.0.2"
                          },
                          {
                            "version_value": "5.0.1"
                          },
                          {
                            "version_value": "6.0"
                          },
                          {
                            "version_value": "6.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124557."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "L",
              "I": "L",
              "PR": "L",
              "S": "C",
              "UI": "R"
            },
            "TM": {
              "E": "H",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-Site Scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ibm-rhapsody-cve20181535-xss(142557)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142557"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=ibm10716029",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=ibm10716029"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2018-1535",
    "datePublished": "2018-07-19T14:00:00.000Z",
    "dateReserved": "2017-12-13T00:00:00.000Z",
    "dateUpdated": "2024-09-16T20:52:22.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-23901

CVE-2018-1535 (GCVE-0-2018-1535)

Tags

Sightings

Nomenclature