IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3複数の脆弱性（認証情報のチェック)

medium Nessus プラグイン ID 61565

Language:

概要

リモートホストに、複数の脆弱性の影響を受ける可能性のあるソフトウェアがインストールされています。

説明

リモートホストに、7.1.2.7 以前の 7.x / 8.0.0.3 以前の 8.0.0.x の IBM Rational ClearQuest がインストールされています。したがって、次の脆弱性の影響を受けます。

- A cross-site scripting vulnerability exists that can be exploited by an attacker by tricking a victim into opening a specially crafted report. (CVE-2012-2205)

- An information disclosure vulnerability exists that allows an attacker unauthorized access to password information. (CVE-2012-2165)

- ClearQuest Web sometimes displays sensitive stack trace information in error messages. (CVE-2012-2168)

- The ClearQuest Web Help component contains a reflected cross-site scripting vulnerability. (CVE-2012-2161)

- Some scripts inside the ClearQuest Web Help application are vulnerable to open redirect attacks. (CVE-2012-2159)

- The ClearQuest web client is subject to an elevated privilege attack that allows an attacker access to the 'Site Administration' menu. (CVE-2012-2164)

- The ClearQuest web client file-upload functionality is affected by a cross-site scripting vulnerability that can be exploited by an authenticated user via the 'File Description' field. (CVE-2012-2169)

- Attackers can obtain potentially sensitive information via a request to a 'snoop', 'hello', 'ivt/', 'hitcount', 'HitCount.jsp', 'HelloHTMLError.jsp', 'HelloHTML.jsp', 'HelloVXMLError.jsp', 'HelloWMLError.jsp', 'HellowWML.jsp' or 'cqweb/j_security_check' sample script. (CVE-2012-0744)