Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-0950: IBM Rational ClearQuest may allow server crashes or internal access

CVE-2014-0950 · published 8 years ago

Summary

Certain web and client parts of IBM Rational ClearQuest can be fooled by specially crafted XML files, causing the application to stop working or to reach other systems on your network. This could lead to service interruptions or unintended data exposure. Apply the latest IBM patches or upgrade to a newer version to protect your environment.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	rational_clearquest	>= 7.1.1, <= 7.1.1.9 >= 7.1.2, <= 7.1.2.13 >= 8.0.0, <= 8.0.0.10 >= 8.0.1, <= 8.0.1.3 `cpe:2.3:a:ibm:rational_clearquest::::::::`

Original advisory text

Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of service or access other servers via crafted XML data. IBM X-Force ID: 92623.

References

http://www-01.ibm.com/support/docview.wss?uid=swg21675164 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/92623 VDB Entry Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.1 High

Exploitation

2% chance of attack within 30 days

Type

CWE-611XML External Entity (XXE)

Timeline

Published20 Apr 2018

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2014-0950 · NVD

Track software like this

Free during beta