Vulnerability CVE-2015-7439 - CERT Civis.Net

Vulnerability Name:

CVE-2015-7439 (CCN-107990)

Assigned:

2015-09-29

Published:

2016-01-22

Updated:

2016-01-28

Summary:

Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA), as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Software Architect for WebSphere Software (RSA4WS) 8.5 through 9.5, and Rational Software Architect RealTime (RSART) 8.5 through 9.5, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVSS v3 Severity:

6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2015-7439

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972909

Source: CCN
Type: IBM Security Bulletin 1972909 (Rational Software Architect)
Vulnerability in IBM InfoSphere Data Architect Cross-Site Scripting affects Rational Software Architect, Rational Software Architect for WebSphere Software and Rational Software Architect RealTime (CVE-2015-7439)

Source: CCN
Type: IBM Security Bulletin 1978003 (Rational Application Developer for WebSphere Software)
Cross-Site Scripting Vulnerability with the UML Vizualization tools

Source: XF
Type: UNKNOWN
ibm-infosphere-cve20157439-xss(107990)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:rational_software_architect_realtime:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:8.5.5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.1.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_realtime:9.5.0:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:ibm:rational_software_architect:8.5.0:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.1:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.1.0:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.2:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.3:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.4:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.0.0:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.0.0.1:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.0:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.1:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.2:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.2.1:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.5.0:*:*:*:websphere:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.1:*:*:*:websphere:*:*:*

Configuration 3:

cpe:/a:ibm:rational_software_architect:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.5.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:rational_software_architect:9.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:8.5.5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect:9.0.0:*:*:*:*:*:*:*

Denotes that component is vulnerable