CVE-2017-1678 : Security Advisory and Response

A cross-site scripting vulnerability affecting IBM Rational DOORS Next Generation versions 4.0, 5.0, and 6.0, allowing injection of arbitrary JavaScript code into the Web UI.

Understanding CVE-2017-1678

What is CVE-2017-1678?

This CVE identifies a cross-site scripting vulnerability in IBM Rational DOORS Next Generation (DNG/RRC) versions 4.0, 5.0, and 6.0, potentially leading to the disclosure of credentials during a trusted session.

The Impact of CVE-2017-1678

The vulnerability enables users to inject malicious JavaScript code into the Web UI, altering intended functionality and posing a risk of credential exposure.

Technical Details of CVE-2017-1678

Vulnerability Description

Cross-site scripting vulnerability in IBM Rational DOORS Next Generation (DNG/RRC) versions 4.0, 5.0, and 6.0
Allows injection of arbitrary JavaScript code into the Web UI
Potential disclosure of credentials during trusted sessions

Affected Systems and Versions

Rational DOORS Next Generation 4.0.7, 5.0, 5.0.1, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4

Exploitation Mechanism

Exploiting the vulnerability allows users to embed arbitrary JavaScript code in the Web UI, modifying intended functionality and potentially leading to credential disclosure.

Mitigation and Prevention

Immediate Steps to Take

Apply the latest security patches provided by IBM
Monitor for any unauthorized access or unusual activities

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities
Educate users on safe browsing practices and the risks of executing unknown scripts

Patching and Updates

IBM has released patches to address the vulnerability in affected versions of Rational DOORS Next Generation