{"id":"CVE-2020-4865","state":"PUBLISHED","title":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func","description":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190741.","publishedAt":"2021-01-27T16:15:27.819Z","updatedAt":"2024-09-16T20:21:28.445Z","severity":{"score":5.4,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/PR:L/C:L/I:L/AC:L/S:C/UI:R/A:N/RL:O/RC:C/E:H","source":"ibm"},"assigner":"ibm","products":["IBM Engineering Lifecycle Optimization","IBM Rational Rhapsody Design Manager","IBM Engineering Test Management","IBM Rational Collaborative Lifecycle Management","IBM Rational Team Concert","IBM Rational Quality Manager","IBM Rational DOORS Next Generation","IBM Rational Engineering Lifecycle Manager","IBM Engineering Workflow Management","IBM Rational Rhapsody Model Manager"],"affected":[{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Design Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"6.0.2","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6408694","https://exchange.xforce.ibmcloud.com/vulnerabilities/190741"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:32.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/4xxx/CVE-2020-4865.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-4865","state":"PUBLISHED","datePublished":"2021-01-27T16:15:27.819Z","dateUpdated":"2024-09-16T20:21:28.445Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2019-12-30T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190741."}],"affected":[{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Design Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"7.0","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"6.0.2","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6408694","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/190741","name":"ibm-engineering-cve20204865-xss (190741)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","exploitCodeMaturity":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"CHANGED","temporalScore":5.2,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/PR:L/C:L/I:L/AC:L/S:C/UI:R/A:N/RL:O/RC:C/E:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Cross-Site Scripting","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2021-01-27T16:15:27.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2021-01-26T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2021-01-26T00:00:00","ID":"CVE-2020-4865","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Engineering Lifecycle Optimization","version":{"version_data":[{"version_value":"7.0"}]}},{"product_name":"Rational Rhapsody Design Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Engineering Test Management","version":{"version_data":[{"version_value":"7.0.0"}]}},{"product_name":"Rational Collaborative Lifecycle Management","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational Team Concert","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational Quality Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational DOORS Next Generation","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"}]}},{"product_name":"Rational Engineering Lifecycle Manager","version":{"version_data":[{"version_value":"7.0"}]}},{"product_name":"Engineering Workflow Management","version":{"version_data":[{"version_value":"7.0"},{"version_value":"7.0.2"}]}},{"product_name":"Rational Rhapsody Model Manager","version":{"version_data":[{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"6.0.2"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190741."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"L","AV":"N","C":"L","I":"L","PR":"L","S":"C","UI":"R"},"TM":{"E":"H","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Scripting"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/6408694","refsource":"CONFIRM","title":"IBM Security Bulletin 6408694 (Rational DOORS Next Generation)","url":"https://www.ibm.com/support/pages/node/6408694"},{"name":"ibm-engineering-cve20204865-xss (190741)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/190741"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6408694","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/190741","name":"ibm-engineering-cve20204865-xss (190741)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T08:14:59.128Z"}}]}}}