CVE-2021-20338

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194449.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
IBMEngineering Test Management7.0.0; 7.0.1
IBMRational Rhapsody Model Manager6.0.6; 6.0.6.1; 7.0
IBMRational Quality Manager6.0.6; 6.0.6.1
IBMEngineering Lifecycle Optimization7.0; 7.0.1; 7.0.2
IBMRational Engineering Lifecycle Manager6.0.6; 6.0.6.1; 7.0; 7.0.1; 7.0.2
IBMRational Collaborative Lifecycle Management6.0.6; 6.0.6.1
IBMRational DOORS Next Generation6.0.6; 6.0.6.1; 7.0; 7.0.1; 7.0.2

References

Timeline

Published
Jun 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-20348.2Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Supported versions that are CVE-2021-203405.4IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the WCVE-2021-203415.3IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attaCVE-2021-203435.4IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacCVE-2021-203455.4IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacCVE-2021-203465.4IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacCVE-2021-203475.4IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacCVE-2021-203485.4IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacCVE-2021-203495.3IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attackCVE-2021-20358.8Vulnerability in the RDBMS Scheduler component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c aCVE-2021-203505.4IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the WCVE-2021-203515.4IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W