Summaryinfo

A vulnerability described as problematic has been identified in IBM Jazz Team Server. This impacts an unknown function. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2017-1734. The attack may be performed from remote. There is no available exploit. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in IBM Jazz Team Server (unknown version). Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational Engineering Lifecycle Manager (RELM), Rational Team Concert (RTC), Rational Quality Manager (RQM), Rational Rhapsody Design Manager (Rhapsody DM), and Rational Software Architect (RSA DM) stores potentially sensitive information in a cache that could be read by authenticated users. IBM X-Force ID: 134915.

The bug was discovered 04/18/2018. The weakness was presented 04/24/2018 (Website). The advisory is available at exchange.xforce.ibmcloud.com. This vulnerability is handled as CVE-2017-1734 since 11/30/2016. The attack may be launched remotely. The requirement for exploitation is a simple authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/07/2023). It is expected to see the exploit prices for this product increasing in the near future.This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-117028 and VDB-117029 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• IBM

Name

• Jazz Team Server

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion