{"id":"CVE-2020-4855","state":"PUBLISHED","title":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func","description":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457.","publishedAt":"2021-01-27T16:15:27.177Z","updatedAt":"2024-09-17T01:46:27.762Z","severity":{"score":5.4,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AC:L/A:N/UI:R/S:C/I:L/PR:L/C:L/AV:N/RC:C/RL:O/E:H","source":"ibm"},"assigner":"ibm","products":["IBM Rational Collaborative Lifecycle Management","IBM Rational Team Concert","IBM Rational Quality Manager","IBM Rational DOORS Next Generation","IBM Engineering Lifecycle Optimization","IBM Rational Rhapsody Design Manager","IBM Engineering Test Management","IBM Rational Engineering Lifecycle Manager","IBM Engineering Workflow Management","IBM Rational Rhapsody Model Manager"],"affected":[{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Design Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"6.0.2","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6408694","https://exchange.xforce.ibmcloud.com/vulnerabilities/190457"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:32.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/4xxx/CVE-2020-4855.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-4855","state":"PUBLISHED","datePublished":"2021-01-27T16:15:27.177Z","dateUpdated":"2024-09-17T01:46:27.762Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2019-12-30T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457."}],"affected":[{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Design Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"6.0.2","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6408694","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/190457","name":"ibm-engineering-cve20204855-xss (190457)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","exploitCodeMaturity":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"CHANGED","temporalScore":5.2,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AC:L/A:N/UI:R/S:C/I:L/PR:L/C:L/AV:N/RC:C/RL:O/E:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Cross-Site Scripting","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2021-01-27T16:15:27.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2021-01-26T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2021-01-26T00:00:00","ID":"CVE-2020-4855","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Rational Collaborative Lifecycle Management","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational Team Concert","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational Quality Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational DOORS Next Generation","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"}]}},{"product_name":"Engineering Lifecycle Optimization","version":{"version_data":[{"version_value":"7.0"}]}},{"product_name":"Rational Rhapsody Design Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Engineering Test Management","version":{"version_data":[{"version_value":"7.0.0"}]}},{"product_name":"Rational Engineering Lifecycle Manager","version":{"version_data":[{"version_value":"7.0"}]}},{"product_name":"Engineering Workflow Management","version":{"version_data":[{"version_value":"7.0"},{"version_value":"7.0.2"}]}},{"product_name":"Rational Rhapsody Model Manager","version":{"version_data":[{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"6.0.2"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"L","AV":"N","C":"L","I":"L","PR":"L","S":"C","UI":"R"},"TM":{"E":"H","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Scripting"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/6408694","refsource":"CONFIRM","title":"IBM Security Bulletin 6408694 (Rational DOORS Next Generation)","url":"https://www.ibm.com/support/pages/node/6408694"},{"name":"ibm-engineering-cve20204855-xss (190457)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/190457"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6408694","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/190457","name":"ibm-engineering-cve20204855-xss (190457)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T08:14:59.117Z"}}]}}}