NVD Vulnerability Detail

CVE-2014-8925

Summary	Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences.
Publication Date	March 25, 2015, 10:59 a.m.
Registration Date	Jan. 26, 2021, 3:21 p.m.
Last Update	Nov. 21, 2024, 11:19 a.m.

CVSS2.0 : MEDIUM
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ibm:rational_clearquest:8.0.0.7:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.6:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.10:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.10:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.13:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.6:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.9:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.5:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.9:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.12:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.0.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.5:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.0.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.15:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.11:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.8:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.14:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.8:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.11:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.6:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.5:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.12:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.8:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.7:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.7:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.9:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.5:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://www-01.ibm.com/support/docview.wss?uid=swg21699148		Patch Vendor Advisory
2	http://www-01.ibm.com/support/docview.wss?uid=swg21699148		Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

IBM Rational ClearQuest の ClearQuest Web におけるクロスサイトリクエストフォージェリの脆弱性

Title	IBM Rational ClearQuest の ClearQuest Web におけるクロスサイトリクエストフォージェリの脆弱性
Summary	IBM Rational ClearQuest の ClearQuest Web には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	第三者により、任意のユーザの認証をハイジャックされ、ログアウトを誘発される、または XSS シーケンスを挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 14, 2014, midnight
Registration Date	March 26, 2015, 4:39 p.m.
Last Update	March 26, 2015, 4:39 p.m.

Affected System

IBM

IBM Rational ClearQuest 7.1.2.17 未満の 7.1.x

IBM Rational ClearQuest 8.0.0.14 未満の 8.0.0.x

IBM Rational ClearQuest 8.0.1.7 未満の 8.0.1.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-8925	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8925
National Vulnerability Database (NVD)
2	CVE-2014-8925	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8925

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
IBM Support Document
1	1699148	http://www-01.ibm.com/support/docview.wss?uid=swg21699148

Change Log

No	Changed Details	Date of change
0	[2015年03月26日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ibm:rational_clearquest:8.0.0.7:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.6:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.10:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.10:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.13:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.6:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.9:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.5:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.9:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.12:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.0.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.5:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.0.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.15:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.11:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.8:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.14:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.8:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.11:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.3:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.2:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.6:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.5:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.12:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.8:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.7:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.2.4:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:7.1.1.7:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.9:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.1:::::::*
cpe:2.3:a:ibm:rational_clearquest:8.0.0.5:::::::*