NetSight
IP …
medium6.0

CVE-2014-3037

Cross-site request forgery (CSRF) vulnerability in IBM Configuration Management Application (aka VVC) in IBM Rational Engineering Lifecycle Manager before 4.0.…

Impact

Cross-site request forgery (CSRF) vulnerability in IBM Configuration Management Application (aka VVC) in IBM Rational Engineering Lifecycle Manager before 4.0.7 and 5.x before 5.0.1, Rational Software Architect Design Manager before 4.0.7 and 5.x before 5.0.1, and Rational Rhapsody Design Manager before 4.0.7 and 5.x before 5.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Affected products

VendorProductAffected versions
IbmRational Rhapsody Design Manager
through 4.0.6
Versions 3.0, 3.0.0.1, 3.0.1, 4.0, 4.0.1
IbmRational Engineering Lifecycle Manager
through 4.06
Versions 1.0, 1.0.0.1, 4.03, 4.04, 4.05
IbmRational Software Architect Design Manager
through 4.0.6
Versions 3.0, 3.0.0.1, 4.0.0, 4.0.1, 4.0.2

Weakness classification

CWE-352

References