IBM Rational Collaborative Lifecycle Management Jazz Team Server access control

Summaryinfo

A vulnerability has been found in IBM Rational Collaborative Lifecycle Management and classified as problematic. Impacted is an unknown function of the component Jazz Team Server. This manipulation causes access control. This vulnerability is handled as CVE-2015-4946. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in IBM Rational Collaborative Lifecycle Management (the affected version unknown) and classified as problematic. Affected by this vulnerability is an unknown part of the component Jazz Team Server. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Engineering Lifecycle Manager (RELM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; Rational Rhapsody Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; and Rational Software Architect Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1 allows local users to bypass intended access re strictions via unspecified vectors.

The weakness was released 01/03/2016 (Website). The advisory is shared at www-01.ibm.com. This vulnerability is known as CVE-2015-4946 since 06/24/2015. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-80042. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• IBM

Name

• Rational Collaborative Lifecycle Management

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion