CVE-2019-4603

Vulnerability

IBM Quality Manager (RQM) versions 6.0.2, 6.0.6, and 6.0.6.1 allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user [1]. This is an integrity vulnerability that does not require user interaction.

Exploitation

An attacker must have a valid account with network access to the RQM REST API. By crafting a request to the keyword creation endpoint, the attacker can specify a different user as the creator, causing the system to attribute the keyword to that user [1]. No special privileges beyond authenticated access are needed.

Impact

Successful exploitation results in a low integrity impact: the attacker can spoof the creator of a keyword. The CVSS v3.0 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) [1]. No confidentiality or availability impact occurs.

Mitigation

As of the publication date (2020-04-08), no fix or workaround is available from IBM [1]. Users should monitor IBM's security bulletin for updates and apply patches when released.