Information disclosure in IBM Rational Team Concert and Engineering Workflow Management - CVE-2021-29701
Published: January 11, 2022 / Updated: April 12, 2022
Vulnerability identifier: #VU59359
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-29701
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can obtain sensitive information from build definitions and use it in further attacks against the application.
Affected software
IBM Rational Team Concert
Engineering Workflow Management
Engineering Workflow Management
How to mitigate CVE-2021-29701
Install updates from vendor's website.
IBM Rational Team Concert - addressed in versions 6.0.6 iFix024, 6.0.6.1 iFix022
Engineering Workflow Management - addressed in versions 7.0 iFix013, 7.0.1 iFix014, 7.0.2 iFix012
Engineering Workflow Management - addressed in versions 7.0 iFix013, 7.0.1 iFix014, 7.0.2 iFix012