Vulnerability CVE-2014-6131 - CERT Civis.Net

Vulnerability Name:

CVE-2014-6131 (CCN-96811)

Assigned:

2014-09-02

Published:

2015-03-05

Updated:

2015-03-18

Summary:

IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational DOORS Next Generation 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5; and other products, allows remote authenticated users to read the dashboards of arbitrary users via unspecified vectors.

CVSS v3 Severity:

2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

3.5 Low (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2014-6131

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21698247

Source: CCN
Type: IBM Security Bulletin 1698247
Security vulnerability in IBM Jazz Team Server affects multiple IBM Rational products based on IBM Jazz technology (CVE-2014-6131, CVE-2014-6129)

Source: XF
Type: UNKNOWN
ibm-rtc-cve20146131-info-disc(96811)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:rational_doors_next_generation:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_doors_next_generation:5.0.2:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:ibm:rational_requirements_composer:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:2.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_requirements_composer:3.0.1.6:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:ibm:rational_team_concert:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_team_concert:5.0.2:*:*:*:*:*:*:*

Configuration 5:

cpe:/a:ibm:rational_quality_manager:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:2.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_quality_manager:5.0.2:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2:*:*:*:*:*:*:*

Denotes that component is vulnerable