← Back

CVE-2016-0326

nvd nist
Published: Oct 22, 2016Modified: May 6, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and 6.x before 6.0.1 ifix3 allow remote authenticated users to execute arbitrary OS commands via a crafted "HTML request."

Affected (29)

Ibm
2 products
Rational Collaborative Lifecycle Management
Rational Quality Manager
Configuration A
13 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Rational Collaborative Lifecycle Management
Version 4.0.0
Rational Collaborative Lifecycle Management
Version 4.0.1
Rational Collaborative Lifecycle Management
Version 4.0.2
Rational Collaborative Lifecycle Management
Version 4.0.3
Rational Collaborative Lifecycle Management
Version 4.0.4
Rational Collaborative Lifecycle Management
Version 4.0.5
Rational Collaborative Lifecycle Management
Version 4.0.6
Rational Collaborative Lifecycle Management
Version 4.0.7
Rational Collaborative Lifecycle Management
Version 5.0.0
Rational Collaborative Lifecycle Management
Version 5.0.1
Rational Collaborative Lifecycle Management
Version 5.0.2
Rational Collaborative Lifecycle Management
Version 6.0.0
Rational Collaborative Lifecycle Management
Version 6.0.1
Configuration B
16 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Rational Quality Manager
Version 3.0.1.6
Rational Quality Manager
Version 4.0.0.1
Rational Quality Manager
Version 4.0.0.2
Rational Quality Manager
Version 4.0.1
Rational Quality Manager
Version 4.0.2
Rational Quality Manager
Version 4.0.3
Rational Quality Manager
Version 4.0.4
Rational Quality Manager
Version 4.0.5
Rational Quality Manager
Version 4.0.6
Rational Quality Manager
Version 4.0.7
Rational Quality Manager
Version 4.0
Rational Quality Manager
Version 5.0.0
Rational Quality Manager
Version 5.0.1
Rational Quality Manager
Version 5.0.2
Rational Quality Manager
Version 6.0.0
Rational Quality Manager
Version 6.0.1

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

Source: psirt@us.ibm.com
PatchVendor Advisory
Source: psirt@us.ibm.com
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.