Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

IBM Rational CLM suite may expose data through weak encryption

CVE-2015-7449 · published 8 years ago
Summary

Several versions of IBM Rational Collaborative Lifecycle Management, Quality Manager, Team Concert, Requirements Composer, and DOORS Next Generation use weak encryption that can let a local user see sensitive information. Upgrade to the latest iFix releases (e.g., 4.0.7 iFix10, 5.0.2 iFix15, 6.0.1 iFix5, 6.0.2 iFix2, or later) to secure the data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm rational_collaborative_lifecycle_management >= 4.0.0, <= 6.0.2
cpe:2.3:a:ibm:rational_collaborative_lifecycle_management:*:*:*:*:*:*:*:*
ibm rational_quality_manager >= 4.0.0, <= 4.0.7
5.0.0
5.0.1
5.0.2
6.0.0
6.0.1
6.0.2
cpe:2.3:a:ibm:rational_quality_manager:*:*:*:*:*:*:*:*
ibm rational_team_concert >= 4.0.0, <= 4.0.7
5.0.0
5.0.1
5.0.2
6.0.0
6.0.1
6.0.2
cpe:2.3:a:ibm:rational_team_concert:*:*:*:*:*:*:*:*
ibm rational_requirements_composer >= 4.0.0, <= 4.0.7
cpe:2.3:a:ibm:rational_requirements_composer:*:*:*:*:*:*:*:*
ibm rational_doors_next_generation >= 4.0.0, <= 4.0.7
5.0.0
5.0.1
5.0.2
6.0.0
6.0.1
6.0.2
cpe:2.3:a:ibm:rational_doors_next_generation:*:*:*:*:*:*:*:*
ibm rational_engineering_lifecycle_manager >= 4.0.3, <= 4.0.7
5.0.0
5.0.1
5.0.2
6.0.0
6.0.1
6.0.2
cpe:2.3:a:ibm:rational_engineering_lifecycle_manager:*:*:*:*:*:*:*:*
ibm rational_rhapsody_design_manager >= 4.0, <= 4.0.7
5.0.0
5.0.1
5.0.2
6.0.0
6.0.1
6.0.2
cpe:2.3:a:ibm:rational_rhapsody_design_manager:*:*:*:*:*:*:*:*
ibm rational_software_architect_design_manager >= 4.0.0, <= 4.0.7
5.0.0
5.0.1
5.0.2
6.0.0
6.0.1
6.0.2
cpe:2.3:a:ibm:rational_software_architect_design_manager:*:*:*:*:*:*:*:*
Original advisory text
IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager (RQM) 4.0.x be...
IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager (RQM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Team Concert (RTC) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Requirements Composer (RRC) 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 before iFix1, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2 allow local users to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 108221.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-326Inadequate Encryption Strength
Timeline
Published20 Mar 2018
Updated26 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-7449 · NVD
Track software like this
Free during beta