CVE-2017-1100 : What You Need to Know

A security flaw has been discovered in IBM Quality Manager (RQM) versions 4.0, 5.0, and 6.0, allowing the insertion of malicious JavaScript code into the Web UI, posing a risk of credential disclosure within trusted sessions.

Understanding CVE-2017-1100

What is CVE-2017-1100?

IBM Quality Manager (RQM) versions 4.0, 5.0, and 6.0 are vulnerable to Cross-Site Scripting (XSS) attacks, enabling the injection of arbitrary JavaScript code into the Web UI.

The Impact of CVE-2017-1100

This vulnerability could lead to the modification of system functionality, potentially exposing credentials within secure sessions.

Technical Details of CVE-2017-1100

Vulnerability Description

Identified as CVE-2017-1100 by IBM X-Force
Allows users to embed malicious JavaScript code in the Web UI
Risk of credential disclosure within trusted sessions

Affected Systems and Versions

Rational Quality Manager versions 4.0, 4.0.1, 4.0.3, 4.0.0.1, 4.0.0.2, 4.0.2, 4.0.4, 4.0.5, 4.0.6, 5.0, 4.0.7, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3

Exploitation Mechanism

Malicious JavaScript injection into the Web UI
Alters system functionality
Potential disclosure of credentials

Mitigation and Prevention

Immediate Steps to Take

Apply security patches provided by IBM
Monitor and restrict user input to prevent XSS attacks

Long-Term Security Practices

Regular security assessments and code reviews
Educate users on safe browsing habits

Patching and Updates

Stay updated with security advisories from IBM
Implement patches promptly to address vulnerabilities