Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2012-0736: IBM Rational AppScan Enterprise can run attacker code

CVE-2012-0736 · published 14 years ago

Summary

IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 may incorrectly set up scan jobs. This flaw lets a remote attacker cause the software to execute code of their choice from a malicious website. Upgrade to version 8.5.0.1 or later, or apply the vendor’s recommended patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	rational_appscan	5.2 5.4 5.5.0 5.5.0.1 5.5.0.2 5.6.0 5.6.0.3 8.0.0 8.0.0.1 8.0.0.2 8.0.0.3 8.0.1 3 more version ranges `cpe:2.3:a:ibm:rational_appscan:5.2::enterprise:::::`

Original advisory text

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.3 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published3 May 2012

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2012-0736 · NVD

Track software like this

Free during beta