CVE-2012-2164

The Web client in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to bypass intended access restrictions, and use the Site Administration menu to modify system settings, via a parameter-tampering attack.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1PM62735	Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21606318	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/75039

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:rational_clearquest:7.1.1.1:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.2:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.3:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.4:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.5:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.6:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.7:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.1.8:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2.1:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2.2:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2.3:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2.4:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2.5:::::::*
	cpe:2.3:a:ibm:rational_clearquest:7.1.2.6:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:rational_clearquest:8.0:::::::*
	cpe:2.3:a:ibm:rational_clearquest:8.0.0.1:::::::*
	cpe:2.3:a:ibm:rational_clearquest:8.0.0.2:::::::*

History

No history.

Information

Published : 2012-08-17 20:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-2164

Mitre link : CVE-2012-2164

CVE.ORG link : CVE-2012-2164

JSON object : View

Products Affected

ibm

rational_clearquest

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-2164", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-08-17T20:55:04.213", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM62735", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.ibm.com/support/docview.wss?uid=swg21606318", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75039", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Web client in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to bypass intended access restrictions, and use the Site Administration menu to modify system settings, via a parameter-tampering attack."}, {"lang": "es", "value": "El cliente Web de IBM Rational ClearQuest v7.1.x antes de v7.1.2.7 y 8.x antes de v8.0.0.3 permite pasar por alto las restricciones de acceso a los usuarios remotos autenticados, y usar el men\u00fa Administraci\u00f3n de sitios para modificar la configuraci\u00f3n del sistema a trav\u00e9s de un ataque de manipulaci\u00f3n de par\u00e1metros."}], "lastModified": "2017-08-29T01:31:32.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AB4DB93-26A7-4B5E-ACF5-B8D95AC31566"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F74EBAA-8A68-4F20-B14D-D1A77D57BC38"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10A1A052-179D-411F-A214-EF2AF7E5F0F5"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "230908F8-95CB-4273-BA32-0987145E5FDD"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57CB4AA1-354B-4EC4-8D70-F58654ABF9CB"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1766896-6D35-44CB-8512-AED3961CE224"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64BC2E3D-4B20-46FF-B2B5-551BEB347FCC"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51B69987-F426-4D27-A721-067B978BEB78"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0201EFB5-9673-4C78-938A-C7BF769F5553"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F1C1C0A-B403-44C5-B7BD-BC9466CB2848"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0A7179A-2421-454C-8A58-EFB1BB7150BC"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FEA9B29-2A30-46D1-B778-CE7822CEA972"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "941C4C5A-DD11-436B-86D4-BC564E9C6B57"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E538615-12E6-4CDF-8B32-A66CD35D98AE"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.1.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F31399A6-5B53-46C1-B4CB-858360CFF133"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:rational_clearquest:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A482D76-5CEA-4BFC-9837-AC451DBD1ACE"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:8.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A51113A6-1744-47E6-8245-C0E33D39C789"}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:8.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33437FA1-E122-43BB-B347-AACD9C9295D6"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}