{"id":"CVE-2020-4733","state":"PUBLISHED","title":"IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended fun","description":"IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127.","publishedAt":"2021-01-08T20:40:25.291Z","updatedAt":"2024-09-17T00:25:50.346Z","severity":{"score":5.4,"label":"Medium","version":"3.0","vector":"CVSS:3.0/PR:L/A:N/S:C/AC:L/UI:R/C:L/I:L/AV:N/RL:O/RC:C/E:H","source":"ibm"},"assigner":"ibm","products":["IBM Rational Collaborative Lifecycle Management","IBM Engineering Workflow Management","IBM Engineering Test Management","IBM Rational Engineering Lifecycle Manager","IBM Rational Quality Manager","IBM Engineering Lifecycle Optimization","IBM Rational DOORS Next Generation","IBM Rational Rhapsody Model Manager","IBM Rational Rhapsody Design Manager","IBM Rational Team Concert"],"affected":[{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"6.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Design Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6398742","https://exchange.xforce.ibmcloud.com/vulnerabilities/188127"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:32.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/4xxx/CVE-2020-4733.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-4733","state":"PUBLISHED","datePublished":"2021-01-08T20:40:25.291Z","dateUpdated":"2024-09-17T00:25:50.346Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2019-12-30T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127."}],"affected":[{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"6.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Design Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6398742","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/188127","name":"ibm-jazz-cve20204733-xss (188127)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","exploitCodeMaturity":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"CHANGED","temporalScore":5.2,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/PR:L/A:N/S:C/AC:L/UI:R/C:L/I:L/AV:N/RL:O/RC:C/E:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Cross-Site Scripting","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2021-01-08T20:40:25.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2021-01-07T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2021-01-07T00:00:00","ID":"CVE-2020-4733","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Rational Collaborative Lifecycle Management","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Engineering Workflow Management","version":{"version_data":[{"version_value":"7.0"},{"version_value":"7.0.1"}]}},{"product_name":"Engineering Test Management","version":{"version_data":[{"version_value":"7.0.0"}]}},{"product_name":"Rational Engineering Lifecycle Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"}]}},{"product_name":"Rational Quality Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Engineering Lifecycle Optimization","version":{"version_data":[{"version_value":"7.0"},{"version_value":"7.0.1"}]}},{"product_name":"Rational DOORS Next Generation","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"}]}},{"product_name":"Rational Rhapsody Model Manager","version":{"version_data":[{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"},{"version_value":"6.0.2"}]}},{"product_name":"Rational Rhapsody Design Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"}]}},{"product_name":"Rational Team Concert","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"L","AV":"N","C":"L","I":"L","PR":"L","S":"C","UI":"R"},"TM":{"E":"H","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Scripting"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/6398742","refsource":"CONFIRM","title":"IBM Security Bulletin 6398742 (Rational Rhapsody Design Manager)","url":"https://www.ibm.com/support/pages/node/6398742"},{"name":"ibm-jazz-cve20204733-xss (188127)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/188127"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6398742","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/188127","name":"ibm-jazz-cve20204733-xss (188127)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T08:14:59.102Z"}}]}}}