CVE-2008-5325

Vulnerability

IBM Rational ClearQuest CQ Web versions 7.0.0 up to (but not including) 7.0.0.4 and 7.0.1 up to (but not including) 7.0.1.3 contain multiple cross-site scripting (XSS) vulnerabilities in unspecified vectors. The issue affects 16 files within the CQ Web component [1].

Exploitation

An attacker can exploit these vulnerabilities by sending a crafted request to the CQ Web interface. No authentication is required, but user interaction (e.g., clicking a malicious link) may be necessary to trigger the XSS in the victim's browser. The exact attack vectors are not disclosed in the available references [1].

Impact

Successful exploitation allows an attacker to execute arbitrary web script or HTML in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. The attacker does not gain direct access to the server but can perform actions on behalf of the authenticated user if the victim is logged in [1].

Mitigation

IBM has released fixes in ClearQuest versions 7.0.0.4 and 7.0.1.3. Users should upgrade to these versions or later. No workarounds are documented in the available references [1].