{"id":"CVE-2020-4920","state":"PUBLISHED","title":"IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the inte","description":"IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396.","publishedAt":"2021-04-12T18:00:23.065Z","updatedAt":"2024-09-16T18:49:15.057Z","severity":{"score":6.4,"label":"Medium","version":"3.0","vector":"CVSS:3.0/A:N/C:L/I:L/PR:L/S:C/AC:L/AV:N/UI:N/RL:O/E:H/RC:C","source":"ibm"},"assigner":"ibm","products":["IBM Rational Engineering Lifecycle Manager","IBM Rational Quality Manager","IBM Rational Team Concert","IBM Rational Collaborative Lifecycle Management","IBM Rational DOORS Next Generation","IBM Engineering Test Management","IBM Engineering Lifecycle Optimization","IBM Engineering Workflow Management","IBM Rational Rhapsody Model Manager"],"affected":[{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"6.0.2","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6441803","https://exchange.xforce.ibmcloud.com/vulnerabilities/191396"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:32.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/4xxx/CVE-2020-4920.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-4920","state":"PUBLISHED","datePublished":"2021-04-12T18:00:23.065Z","dateUpdated":"2024-09-16T18:49:15.057Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2019-12-30T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396."}],"affected":[{"vendor":"IBM","product":"Rational Engineering Lifecycle Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Quality Manager","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Team Concert","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational Collaborative Lifecycle Management","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"}]},{"vendor":"IBM","product":"Rational DOORS Next Generation","versions":[{"version":"6.0.2","status":"affected"},{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Engineering Test Management","versions":[{"version":"7.0.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Engineering Lifecycle Optimization","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Engineering Workflow Management","versions":[{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"7.0.2","status":"affected"}]},{"vendor":"IBM","product":"Rational Rhapsody Model Manager","versions":[{"version":"6.0.6","status":"affected"},{"version":"6.0.6.1","status":"affected"},{"version":"7.0","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"6.0.2","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6441803","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/191396","name":"ibm-engineering-cve20204920-xss (191396)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","exploitCodeMaturity":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"CHANGED","temporalScore":6.1,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.0/A:N/C:L/I:L/PR:L/S:C/AC:L/AV:N/UI:N/RL:O/E:H/RC:C","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Cross-Site Scripting","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2021-04-12T18:00:22.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2021-04-09T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2021-04-09T00:00:00","ID":"CVE-2020-4920","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Rational Engineering Lifecycle Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"}]}},{"product_name":"Rational Quality Manager","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational Team Concert","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational Collaborative Lifecycle Management","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"}]}},{"product_name":"Rational DOORS Next Generation","version":{"version_data":[{"version_value":"6.0.2"},{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"},{"version_value":"7.0.2"}]}},{"product_name":"Engineering Test Management","version":{"version_data":[{"version_value":"7.0.0"},{"version_value":"7.0.1"},{"version_value":"7.0.2"}]}},{"product_name":"Engineering Lifecycle Optimization","version":{"version_data":[{"version_value":"7.0"},{"version_value":"7.0.1"},{"version_value":"7.0.2"}]}},{"product_name":"Engineering Workflow Management","version":{"version_data":[{"version_value":"7.0"},{"version_value":"7.0.1"},{"version_value":"7.0.2"}]}},{"product_name":"Rational Rhapsody Model Manager","version":{"version_data":[{"version_value":"6.0.6"},{"version_value":"6.0.6.1"},{"version_value":"7.0"},{"version_value":"7.0.1"},{"version_value":"6.0.2"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"L","AV":"N","C":"L","I":"L","PR":"L","S":"C","UI":"N"},"TM":{"E":"H","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Scripting"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/6441803","refsource":"CONFIRM","title":"IBM Security Bulletin 6441803 (Rational DOORS Next Generation)","url":"https://www.ibm.com/support/pages/node/6441803"},{"name":"ibm-engineering-cve20204920-xss (191396)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/191396"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6441803","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/191396","name":"ibm-engineering-cve20204920-xss (191396)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T08:14:59.189Z"}}]}}}