CVE-2016-6022

Vulnerability

IBM Quality Manager (RQM) versions 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting (XSS). The vulnerability allows authenticated users to embed arbitrary JavaScript code into the Web UI, which is then executed in the context of other users' sessions. This occurs due to insufficient input validation in certain fields [1].

Exploitation

An attacker with low-privileged access to RQM can inject malicious JavaScript into a field (e.g., a comment or description). When another user views the affected page, the script executes. User interaction (e.g., clicking a link) may be required to trigger the script, as indicated by the CVSS vector requiring user interaction [1].

Impact

Successful exploitation can lead to disclosure of credentials within a trusted session, as the script can capture session tokens or other sensitive data. The CVSS scope is changed, indicating potential impact on other resources beyond the vulnerable component [1].

Mitigation

IBM has addressed this vulnerability in a security update for IBM Jazz Team Server. Users should apply the fix as described in the security bulletin [1]. No workarounds are mentioned in the available references.