Spoofing Vulnerability in IBM Rational ClearQuest Software
CVE-2016-2922

5.9MEDIUM

Key Information:

Vendor

IBM
Status
Rational ClearQuest
Vendor
CVE Published:
13 August 2018

What is CVE-2016-2922?

IBM Rational ClearQuest versions 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 are vulnerable to a spoofing attack due to improper SSL certificate validation. This flaw allows an attacker to perform a man-in-the-middle attack, intercepting and potentially altering communications between the client and server without detection. When the software fails to verify that the SSL certificate presented by the server matches the requested hostname, it leaves users exposed to data breaches and unauthorized access.

Affected Version(s)

Rational ClearQuest 8.0

Rational ClearQuest 8.0.0.1

Rational ClearQuest 8.0.0.2

References

https://www.ibm.com/support/docview.wss?uid=ibm10718377
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/113353
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.