IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm rational collaborative lifecycle management4.0.0 and later · up to 6.0.2 inclusive
• ibm rational doors next generation4.0.0 and later · up to 4.0.7 inclusive
• ibm rational doors next generation5.0.0
• ibm rational doors next generation5.0.1
• ibm rational doors next generation5.0.2
• ibm rational doors next generation6.0.0
• ibm rational doors next generation6.0.1
• ibm rational doors next generation6.0.2
• ibm rational engineering lifecycle manager4.0.3 and later · up to 4.0.7 inclusive
• ibm rational engineering lifecycle manager5.0.0
• ibm rational engineering lifecycle manager5.0.1
• ibm rational engineering lifecycle manager5.0.2
• ibm rational engineering lifecycle manager6.0.0
• ibm rational engineering lifecycle manager6.0.1
• ibm rational engineering lifecycle manager6.0.2
• ibm rational quality manager4.0.0 and later · up to 4.0.7 inclusive
• ibm rational quality manager5.0.0
• ibm rational quality manager5.0.1
• ibm rational quality manager5.0.2
• ibm rational quality manager6.0.0

Other highest-scoring records for the same primary product.

• CVE-2014-0862Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x bef
  41Plan
• CVE-2017-1701IBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using a weak encryption al
  35Monitor
• CVE-2016-0326IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before
  35Monitor
• CVE-2019-4252IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 could allow a remote attacker to traverse directories on the system.
  31Monitor
• CVE-2015-7440IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.
  31Monitor
• CVE-2018-1492IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to
  27Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.