CVE-2015-0121 Auth bypass in n/a
Attackers can hijack sessions on unattended workstations when LTPA SSO is enabled, gaining unauthorized access to IBM Requirements Composer and RDNG.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2015-0121?
CVE-2015-0121 is a low-severity authentication bypass vulnerability in Ibm Rational Doors Next Generation, published on 30 May 2015. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation (RDNG) 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management (RM) session upon LTPA token expiration, which allows remote attackers to obtain access by leveraging an unattended workstation.
Which versions are affected by CVE-2015-0121?
It affects 2 products.
Products include Ibm Rational Doors Next Generation, Ibm Rational Requirements Composer.
How do I fix CVE-2015-0121?
No fix has been published for CVE-2015-0121 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-0121 being exploited?
There is no known exploitation of CVE-2015-0121 in the wild and no public exploit code.
Other vulnerabilities in Ibm Rational Doors Next Generation
- CVE-2015-0132 Denial of service in n/a
- CVE-2018-1911 Cross-site scripting in Rational DOORS Next Generation
- CVE-2018-1912 Cross-site scripting in Rational DOORS Next Generation
- CVE-2018-1610 Cross-site scripting in Rational DOORS Next Generation
- CVE-2017-1753 Cross-site scripting in Rational Collaborative Lifecycle Management
Sources
Also known as GHSA-c9cr-fjpc-6g3v.