Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-4602: IBM Rational ClearQuest web client lets restricted users view any record

CVE-2010-4602 · published 15 years ago

Summary

The web interface of IBM Rational ClearQuest versions before 7.1.1.4 and 7.1.2.1 lets a logged‑in user who should have limited access change a record number in the URL and see any record. This could expose confidential data to users who are not supposed to see it. Apply the latest ClearQuest updates or restrict web access until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	rational_clearquest	7.1.1.1 7.1.1.2 7.1.1.3 7.1.2 `cpe:2.3:a:ibm:rational_clearquest:7.1.1.1:::::::*`

Original advisory text

The Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 allows remote authenticated users to bypass "restricted user" limitations, and read arbitrary records, via a modified record number in the URL for a RECORD action, as demonstrated by a modified bookmark.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.0 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

Timeline

Published29 Dec 2010

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2010-4602 · NVD

Track software like this

Free during beta