CVE-2007-4592

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-03-20 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component.

Affected products

IBM Rational ClearQuest: through 2003-06-16; 7.0.1, 7.0.1.1, 7.0.2

References

http://secunia.com/advisories/29467
http://securityreason.com/securityalert/3753
http://www.securityfocus.com/archive/1/489861/100/0/threaded
http://www.securityfocus.com/bid/28296
http://www.securitytracker.com/id?1019685
http://www.vupen.com/english/advisories/2008/0952/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41328
http://secunia.com/advisories/29467
http://securityreason.com/securityalert/3753
http://www.securityfocus.com/archive/1/489861/100/0/threaded
http://www.securityfocus.com/bid/28296
http://www.securitytracker.com/id?1019685

Get alerted when CVE-2007-4592 or the next vulnerability affects your stack