CVE-2010-4602

The Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 allows remote authenticated users to bypass "restricted user" limitations, and read arbitrary records, via a modified record number in the URL for a RECORD action, as demonstrated by a modified bookmark.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2010-12-29

Last modified

2024-08-07

Weaknesses

CWE-264

Affected products

• Rational Clearquest (Ibm)

References

• http://www-01.ibm.com/support/docview.wss?uid=swg1PM20172
• http://www.securityfocus.com/bid/45646
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64440