IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3 Multiple Vulnerabilities (credentialed check)

medium Nessus Plugin ID 61565

Language:

Synopsis

The remote host has software installed that is affected by multiple vulnerabilities.

Description

The remote host has a version of IBM Rational ClearQuest 7.x prior to 7.1.2.7 / 8.0.0.x prior to 8.0.0.3 installed. It is, therefore, affected by the following vulnerabilities :

- A cross-site scripting vulnerability exists that can be exploited by an attacker by tricking a victim into opening a specially crafted report. (CVE-2012-2205)

- An information disclosure vulnerability exists that allows an attacker unauthorized access to password information. (CVE-2012-2165)

- ClearQuest Web sometimes displays sensitive stack trace information in error messages. (CVE-2012-2168)

- The ClearQuest Web Help component contains a reflected cross-site scripting vulnerability. (CVE-2012-2161)

- Some scripts inside the ClearQuest Web Help application are vulnerable to open redirect attacks. (CVE-2012-2159)

- The ClearQuest web client is subject to an elevated privilege attack that allows an attacker access to the 'Site Administration' menu. (CVE-2012-2164)

- The ClearQuest web client file-upload functionality is affected by a cross-site scripting vulnerability that can be exploited by an authenticated user via the 'File Description' field. (CVE-2012-2169)

- Attackers can obtain potentially sensitive information via a request to a 'snoop', 'hello', 'ivt/', 'hitcount', 'HitCount.jsp', 'HelloHTMLError.jsp', 'HelloHTML.jsp', 'HelloVXMLError.jsp', 'HelloWMLError.jsp', 'HellowWML.jsp' or 'cqweb/j_security_check' sample script. (CVE-2012-0744)

Solution

Upgrade to IBM Rational ClearQuest 7.1.2.7 / 8.0.0.3 or later.

Plugin Details

Severity: Medium

ID: 61565

File Name: ibm_rational_clearquest_7_1_2_7.nasl

Version: 1.12

Type: local

Agent: windows

Family: Windows

Published: 8/16/2012

Updated: 12/4/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2012-2159

Vulnerability Information

CPE: cpe:/a:ibm:rational_clearquest

Required KB Items: installed_sw/IBM Rational ClearQuest

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/26/2012

Vulnerability Publication Date: 6/26/2012

Reference Information

CVE: CVE-2012-0744, CVE-2012-2159, CVE-2012-2161, CVE-2012-2164, CVE-2012-2165, CVE-2012-2168, CVE-2012-2169, CVE-2012-2205

BID: 53884, 54222, 55125

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990

Detections

Analytics