description: IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
problem types: Gain Access
affected:
{
product: Engineering Test Management
vendor: IBM
versions:
status: affected, version: 7.0.0
status: affected, version: 7.0.1
status: affected, version: 7.0.2
}
{
product: Rational Team Concert
vendor: IBM
versions:
status: affected, version: 6.0.6
status: affected, version: 6.0.6.1
}
{
product: Rational Quality Manager
vendor: IBM
versions:
status: affected, version: 6.0.6
status: affected, version: 6.0.6.1
}
{
product: Rational DOORS Next Generation
vendor: IBM
versions:
status: affected, version: 6.0.6
status: affected, version: 6.0.6.1
status: affected, version: 7.0
status: affected, version: 7.0.1
status: affected, version: 7.0.2
}
{
product: Rational Collaborative Lifecycle Management
vendor: IBM
versions:
status: affected, version: 6.0.2
status: affected, version: 6.0.6
status: affected, version: 6.0.6.1
}
{
product: Engineering Workflow Management
vendor: IBM
versions:
status: affected, version: 7.0
status: affected, version: 7.0.1
status: affected, version: 7.0.2
}
{
product: Engineering Lifecycle Optimization
vendor: IBM
versions:
status: affected, version: 7.0
status: affected, version: 7.0.1
status: affected, version: 7.0.2
}
{
product: Rational Engineering Lifecycle Manager
vendor: IBM
versions:
status: affected, version: 6.0.2
status: affected, version: 6.0.6
status: affected, version: 6.0.6.1
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.0/A:L/UI:N/C:L/AV:N/PR:L/I:L/AC:L/S:U/RC:C/E:U/RL:O
version: 3.0
]