Unscored severity · published Dec 10, 2013
CVE-2013-5404
Cross-site scripting (XSS) vulnerability in the search implementation in IBM Rational Quality Manager (RQM) 2.0 through 2.0.1.1, 3.x before 3.0.1.6 iFix 1, and 4.x before 4.0.5,…
–
CVSS
0.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the search implementation in IBM Rational Quality Manager (RQM) 2.0 through 2.0.1.1, 3.x before 3.0.1.6 iFix 1, and 4.x before 4.0.5, as used in Rational Team Concert, Rational Requirements Composer, and other products, allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IFRAME element.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RQ
Rational Quality Manager · Ibm
2.0; 2.0.0.1; 2.0.0.2; 2.0.1; 2.0.1.1; 3.0; +14 more · source: NVD
RR
Rational Requirements Composer · Ibm
2.0; 2.0.0.1; 2.0.0.2; 2.0.0.3; 2.0.0.4; 3.0; +12 more · source: NVD
RT
Rational Team Concert · Ibm
2.0; 2.0.0.1; 2.0.0.2; 3.0; 3.0.1; 3.0.1.2; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5404
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21653689
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/87318
More from Rational Quality Manager
8.8
CVE-2020-4495
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control
8.8
CVE-2016-0326
IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and 6.x before 6.0.1…
8.1
CVE-2017-1103
IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data
8.1
CVE-2016-9707
IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data
7.8
CVE-2015-7440
IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4;…