CVE-2014-0845

Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

CVSS v2.0 4.9 MEDIUM

4.9^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:N

Exploitability : 6.8 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21664412	Vendor Advisory
http://www.securityfocus.com/bid/65916
https://exchange.xforce.ibmcloud.com/vulnerabilities/90719

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.1:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.2:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.3:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.4:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.5:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.6:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.0:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.0.1:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.0.2:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.1:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.2:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.3:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.4:::::::*
	cpe:2.3:a:ibm:rational_requirements_composer:4.0.5:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:rational_doors_next_generation:4.0.0:::::::*
	cpe:2.3:a:ibm:rational_doors_next_generation:4.0.1:::::::*
	cpe:2.3:a:ibm:rational_doors_next_generation:4.0.2:::::::*
	cpe:2.3:a:ibm:rational_doors_next_generation:4.0.3:::::::*
	cpe:2.3:a:ibm:rational_doors_next_generation:4.0.4:::::::*
	cpe:2.3:a:ibm:rational_doors_next_generation:4.0.5:::::::*

History

No history.

Information

Published : 2014-03-04 22:55

Updated : 2017-08-29 01:34

NVD link : CVE-2014-0845

Mitre link : CVE-2014-0845

CVE.ORG link : CVE-2014-0845

JSON object : View

Products Affected

ibm

rational_requirements_composer
rational_doors_next_generation

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2014-0845", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-03-04T22:55:03.320", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21664412", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/65916", "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90719", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL."}, {"lang": "es", "value": "Vulnerabilidad de redirecci\u00f3n abierta en IBM Rational Requirements Composer 3.x anterior a 3.0.1.6 iFix2 y 4.x anterior a 4.0.6 y Rational DOORS Next Generation 4.x anterior a 4.0.6 permite a usuarios remotos autenticados redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a trav\u00e9s de una URL manipulada."}], "lastModified": "2017-08-29T01:34:16.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AF24AEA-D261-485F-A7FF-D5DAF033C571"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDD53B1B-BCD3-4A8D-8FBB-4965FA30D9E0"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0FA509F-C96E-428C-A69A-7D96E1C219B9"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0229C996-3960-4A7A-BA2E-03819281CA6D"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0FBFCAE-0324-4C8B-82F4-1EBFA440CB1F"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17099F68-B49C-4433-98B6-7C7FE8846702"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:3.0.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D43547B3-1085-48B1-A6D3-32B791EE09FE"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF6342F6-709A-4043-A879-57E9C7232C48"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1CDFA1C-9C07-4744-95F9-93A2332E2F13"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10D8C43B-C109-44E1-868F-7DC1289D9BA8"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEAAF6E2-74BE-4FB2-AE49-3C58F68BCEFB"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44EF2B1F-1CD0-4B6E-8C86-622B0E000F8E"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EFFBB5B-8566-45BC-9123-5418821E6EB1"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BF2CC2A-232C-43A6-8C9B-E6125C051BF9"}, {"criteria": "cpe:2.3:a:ibm:rational_requirements_composer:4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A84EA62-E3F8-4E4C-9FEF-065300C4611A"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:rational_doors_next_generation:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "817714F1-B68E-41DB-A4FC-34FD5518B9BB"}, {"criteria": "cpe:2.3:a:ibm:rational_doors_next_generation:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0477D24-56F7-46A2-A08A-C20A90E6E85C"}, {"criteria": "cpe:2.3:a:ibm:rational_doors_next_generation:4.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CABBD25-7C8D-4CE1-B9C9-75670C8B5B09"}, {"criteria": "cpe:2.3:a:ibm:rational_doors_next_generation:4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31D9D1B5-C3D1-42F2-A963-9FA30CF20AA0"}, {"criteria": "cpe:2.3:a:ibm:rational_doors_next_generation:4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0514FAC-52CE-41F6-B255-E2D83E71F3E9"}, {"criteria": "cpe:2.3:a:ibm:rational_doors_next_generation:4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACA25E78-52E0-4B5E-AECC-0F24C827F3F2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}

4.9 /10