CVE-2017-1602
MEDIUMCVSS 4.3/10EPSS 1.23%
Last modified
CVE-2017-1602 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.. EPSS estimates a 1.23% chance of exploitation in the next 30 days.
Description
IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.
Metrics
CVSS:3.0/A:N/AC:L/AV:N/C:N/I:L/PR:L/S:U/UI:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Rational Collaborative Lifecycle Management | >= 4.0.0, <= 6.0.5 |
| Ibm | Rational Quality Manager | >= 4.0.0, <= 4.0.7 |
| Ibm | Rational Quality Manager | >= 6.0.0, <= 6.0.5 |
| Ibm | Rational Quality Manager | 5.0.0 |
| Ibm | Rational Quality Manager | 5.0.1 |
| Ibm | Rational Quality Manager | 5.0.2 |
| Ibm | Rational Team Concert | >= 4.0.0, <= 4.0.7 |
| Ibm | Rational Team Concert | >= 6.0.0, <= 6.0.5 |
| Ibm | Rational Team Concert | 5.0.0 |
| Ibm | Rational Team Concert | 5.0.1 |
| Ibm | Rational Team Concert | 5.0.2 |
| Ibm | Rational Doors Next Generation | >= 4.0.1, <= 4.0.7 |
| Ibm | Rational Doors Next Generation | >= 6.0.0, <= 6.0.5 |
| Ibm | Rational Doors Next Generation | 5.0.0 |
| Ibm | Rational Doors Next Generation | 5.0.1 |
| Ibm | Rational Doors Next Generation | 5.0.2 |
| Ibm | Rational Engineering Lifecycle Manager | >= 4.0.3, <= 4.0.7 |
| Ibm | Rational Engineering Lifecycle Manager | >= 6.0.0, <= 6.0.5 |
| Ibm | Rational Engineering Lifecycle Manager | 5.0.0 |
| Ibm | Rational Engineering Lifecycle Manager | 5.0.1 |
| Ibm | Rational Engineering Lifecycle Manager | 5.0.2 |
| Ibm | Rational Rhapsody Design Manager | >= 4.0, <= 4.0.7 |
| Ibm | Rational Rhapsody Design Manager | >= 6.0.0, <= 6.0.5 |
| Ibm | Rational Rhapsody Design Manager | 5.0.0 |
| Ibm | Rational Rhapsody Design Manager | 5.0.1 |
| Ibm | Rational Rhapsody Design Manager | 5.0.2 |
| Ibm | Rational Software Architect Design Manager | >= 4.0.0, <= 4.0.7 |
| Ibm | Rational Software Architect Design Manager | 5.0.0 |
| Ibm | Rational Software Architect Design Manager | 5.0.1 |
| Ibm | Rational Software Architect Design Manager | 5.0.2 |
| Ibm | Rational Software Architect Design Manager | 6.0.0 |
| Ibm | Rational Software Architect Design Manager | 6.0.1 |
References
- http://www.ibm.com/support/docview.wss?uid=swg22014815Patch, Vendor Advisory
- http://www.securityfocus.com/bid/103477Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/132625VDB Entry, Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22014815Patch, Vendor Advisory
- http://www.securityfocus.com/bid/103477Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/132625VDB Entry, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1602?
IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.
How severe is CVE-2017-1602?
CVE-2017-1602 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 1.23% probability of exploitation in the next 30 days.
How do I fix CVE-2017-1602?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-16014Http-proxy is a proxying library. Because of the way errors …7.5
- CVE-2017-16015Forms is a library for easily creating HTML forms. Versions …
- CVE-2017-16016Sanitize-html is a library for scrubbing html input of malic…
- CVE-2017-16017sanitize-html is a library for scrubbing html input for mali…
- CVE-2017-16018Restify is a framework for building REST APIs. Restify >=2.0…
- CVE-2017-16019GitBook is a command line tool (and Node.js library) for bui…
- CVE-2017-16020Summit is a node web framework. When using the PouchDB drive…9.8
- CVE-2017-16021uri-js is a module that tries to fully implement RFC 3986. O…6.5
- CVE-2017-16022Morris.js creates an svg graph, with labels that appear when…
- CVE-2017-16023Decamelize is used to convert a dash/dot/underscore/space se…
- CVE-2017-16024The sync-exec module is used to simulate child_process.execS…
- CVE-2017-16025Nes is a websocket extension library for hapi. Hapi is a web…
Are you affected by CVE-2017-1602?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST