CVE-2016-2922 Security feature bypass in Rational ClearQuest
Man-in-the-middle attackers can intercept data in IBM Rational ClearQuest due to missing SSL hostname verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-2922?
CVE-2016-2922 is a low-severity vulnerability in IBM Rational ClearQuest, published on 13 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM X-Force ID: 113353.
Weakness: CWE-295
Which versions are affected by CVE-2016-2922?
It affects 1 product.
Products include Ibm Rational Clearquest.
How do I fix CVE-2016-2922?
No fix has been published for CVE-2016-2922 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-2922 being exploited?
There is no known exploitation of CVE-2016-2922 in the wild and no public exploit code.
Other vulnerabilities in IBM Rational ClearQuest
- CVE-2010-4601 Other in n/a
- CVE-2012-0708 Memory corruption in n/a
- CVE-2011-1390 SQL injection in n/a
- CVE-2010-2517 Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report.
- CVE-2008-5329 Missing authorization in n/a
Sources
Also known as GHSA-jm2m-hh98-h83r.