CVE-2017-1602

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
IBM	Rational Collaborative Lifecycle Management	5.0; 5.0.1; 5.0.2; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5

References

http://www.ibm.com/support/docview.wss?uid=swg22014815Patch, Vendor Advisory
http://www.securityfocus.com/bid/103477Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/132625VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22014815Patch, Vendor Advisory
http://www.securityfocus.com/bid/103477Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/132625VDB Entry, Vendor Advisory

Timeline

Published: Mar 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160209.8Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary CVE-2017-160216.5uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not CVE-2017-160226.1Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5 CVE-2017-160237.5Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular express CVE-2017-160246.5The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before CVE-2017-160255.9Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vu CVE-2017-160265.9Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non CVE-2017-160285.3react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-CVE-2017-160297.5hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3 CVE-2017-160307.5Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own heade CVE-2017-160317.5Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Ma CVE-2017-160358.1The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from ap