CVE-2021-29786 Information disclosure in Engineering Lifecycle Optimization
Authenticated users can read stored user credentials in clear text from IBM Jazz Team Server products.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29786?
CVE-2021-29786 is a medium-severity vulnerability in Ibm Rational Collaborative Lifecycle Management, published on 27 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172.
Weakness: CWE-312
Which versions are affected by CVE-2021-29786?
It affects 6 products.
Products include Ibm Engineering Lifecycle Optimization, Ibm Engineering Workflow Management, Ibm Rational Collaborative Lifecycle Management, Ibm Rational Doors Next Generation, Ibm Rational Engineering Lifecycle Manager, Ibm Rational Team Concert.
How do I fix CVE-2021-29786?
No fix has been published for CVE-2021-29786 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-29786 being exploited?
There is no known exploitation of CVE-2021-29786 in the wild and no public exploit code.
Other vulnerabilities in Ibm Rational Collaborative Lifecycle Management
- CVE-2023-45191 IBM Engineering Lifecycle Optimization information disclosure
- CVE-2021-29774 Privilege escalation in Engineering Lifecycle Optimization
- CVE-2023-45187 IBM Engineering Lifecycle Optimization - Publishing session fixation
- CVE-2024-52890 IBM Engineering Lifecycle Optimization - Publishing cross-site scripting
- CVE-2021-29673 Cross-site scripting in Engineering Lifecycle Optimization
All Ibm Rational Collaborative Lifecycle Management vulnerabilities
Sources
Also known as GHSA-x2h8-3vcp-jmgr.