CVE-2021-20502

Published: Mar 30, 2021Modified: Nov 21, 2024

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 198059.

Affected (14)

Products: Ibm: Engineering Insights, Engineering Lifecycle Management, Engineering Requirements Quality Assistant On Premises, Engineering Workflow Management, Rational Engineering Lifecycle Manager, Rational Team Concert

Ibm

6 products

Engineering Insights

Engineering Lifecycle Management

Engineering Requirements Quality Assistant On Premises

Engineering Workflow Management

Rational Engineering Lifecycle Manager

Rational Team Concert

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Ibm Engineering Insights	Version 7.0.1
Ibm Engineering Insights	Version 7.0.2
Ibm Engineering Insights	Version 7.0
Ibm Engineering Lifecycle Management	Version 7.0
Ibm Engineering Requirements Quality Assistant On Premises	All versions
Ibm Engineering Workflow Management	Version 7.0.0
Ibm Engineering Workflow Management	Version 7.0.1
Ibm Engineering Workflow Management	Version 7.0.2
Ibm Rational Engineering Lifecycle Manager	Version 6.0.2
Ibm Rational Engineering Lifecycle Manager	Version 6.0.6.1
Ibm Rational Engineering Lifecycle Manager	Version 6.0.6
Ibm Rational Team Concert	Version 6.0.6.1
Ibm Rational Team Concert	Version 6.0.6.2
Ibm Rational Team Concert	Version 6.0.6