CVE-2021-29790: XSS
IBM Engineering Requirements Quality Assistant is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203440.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-29790?
CVE-2021-29790 is a vulnerability in IBM Engineering Requirements Quality Assistant On-Premises that allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure.
What is the severity of CVE-2021-29790?
The severity of CVE-2021-29790 is medium with a CVSS score of 5.4.
How does CVE-2021-29790 affect IBM Engineering Requirements Quality Assistant On-Premises?
CVE-2021-29790 affects all versions of IBM Engineering Requirements Quality Assistant On-Premises.
How can an attacker exploit CVE-2021-29790?
An attacker can exploit CVE-2021-29790 by embedding arbitrary JavaScript code in the Web UI to alter the intended functionality and potentially disclose credentials.
Is there a fix for CVE-2021-29790?
Yes, IBM has provided a fix for CVE-2021-29790. Please refer to the official IBM support page for more information.