IBM Rational Vulnerability Advisory: CVE-2017-1191/1365

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2017-1191, CVE-2017-1365 Affected Products: IBM Rational products, including CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM Vulnerability Details CVE-2017-1191 Description: An undisclosed vulnerability exists in the CLM application, potentially allowing unrestricted URL access. CVSS Score: - Base Score: 3.1 - Temporal Score: Refer to detailed link - Environmental Score: Not defined CVE-2017-1365 Description: Rational Team Concert (RTC) contains a Cross-Site Scripting (XSS) vulnerability, enabling users to embed arbitrary JavaScript code in the Web UI, potentially leading to credential leakage during sessions. CVSS Score: - Base Score: 5.4 - Temporal Score: Refer to detailed link - Environmental Score: Not defined Affected Products and Versions CLM: 4.0 - 6.0.4 RQM: 4.0 - 6.0.4 RTC: 4.0 - 6.0.4 RDNG: 4.0.1 - 6.0.4 RLM: 4.0.3 - 6.0.4 Rhapsody DM: 4.0 - 6.0.4 RSA DM: 4.0 - 6.0.1 Remediation Measures 6.0 - 6.0.4 Versions: Upgrade to 6.0.4 iFix6 or later. 5.x Versions: Upgrade to 5.0.2 iFix24 or later. 4.x Versions: Upgrade to 4.0.7 iFix15 or later. Workarounds and Mitigations Workarounds: None Mitigations: Upgrade to fixed versions and maintain software updates. Important Notes IBM recommends that System z users subscribe to the System z Security Portal to receive the latest critical security and integrity services. Review CVSS scores and apply all security or integrity fixes to minimize potential risks. References Complete CVSS v2 Guide Online Calculator v2 Complete CVSS v3 Guide Online Calculator v3

Goal Reached Thanks to every supporter — we hit 100%!

IBM Rational Vulnerability Advisory: CVE-2017-1191/1365