CVE-2009-4357

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-12-18T19:00:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "1023370", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1023370"}, {"name": "37385", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/37385"}, {"name": "37811", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37811"}, {"name": "PK86377", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377"}, {"name": "ADV-2009-3580", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/3580"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-4357", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1023370", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1023370"}, {"name": "37385", "refsource": "BID", "url": "http://www.securityfocus.com/bid/37385"}, {"name": "37811", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/37811"}, {"name": "PK86377", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377"}, {"name": "ADV-2009-3580", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/3580"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:01:20.363Z"}, "title": "CVE Program Container", "references": [{"name": "1023370", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1023370"}, {"name": "37385", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/37385"}, {"name": "37811", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37811"}, {"name": "PK86377", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377"}, {"name": "ADV-2009-3580", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/3580"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-4357", "datePublished": "2009-12-18T19:00:00.000Z", "dateReserved": "2009-12-18T00:00:00.000Z", "dateUpdated": "2024-09-17T03:59:45.984Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:rational_clearcase:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3717DBA-FF31-4542-BE04-FD2B89447B6B", "versionEndIncluding": "7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearcase:7.0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "1D00DF56-BFB1-4B91-95A4-0A2F33074AE7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearcase:7.0.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "58FCE9A7-B9C0-470D-A71D-2A94F826A907", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearcase:7.0.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "63308FC2-AE4D-4D50-B969-6AB28A77E550", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearcase:7.0.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "89778E9A-90E8-4467-A33B-5F2BB0762A55", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearcase:7.0.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "6E293794-7223-46EE-BA6A-EF0535566312", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:5.00:*:*:*:*:*:*:*", "matchCriteriaId": "49CA0764-1ACB-4173-8396-36DD513CD538", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:5.20:*:*:*:*:*:*:*", "matchCriteriaId": "66343779-B8F9-4338-B949-3838AC7471B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.00:*:*:*:*:*:*:*", "matchCriteriaId": "8A02B2A2-7D88-47AB-95C8-E38A0C174A02", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.10:*:*:*:*:*:*:*", "matchCriteriaId": "3A5E8200-BB7C-48DE-B946-27535E6F5D6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.12:*:*:*:*:*:*:*", "matchCriteriaId": "3C470CD7-AD2F-450A-BDD2-97328BCD3375", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.13:*:*:*:*:*:*:*", "matchCriteriaId": "6B751150-4AA5-4D2A-992D-5183402F5B33", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.14:*:*:*:*:*:*:*", "matchCriteriaId": "F41B74B7-3941-4B02-A2E5-43A506A593E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.15:*:*:*:*:*:*:*", "matchCriteriaId": "741D5574-B635-46F5-BAC5-5427E0B305CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:6.16:*:*:*:*:*:*:*", "matchCriteriaId": "3C11BD51-B4FB-4717-B614-EC2785C20493", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "37B059D3-5A21-48FA-8D9D-F0DEB8CBB909", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "266BE1E1-AD1C-49DD-81C6-4840EE36CDCE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2EBBBF4D-97FD-4DBC-B296-4235BAD38F61", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "741C008D-917B-44BB-AB20-6A662668B526", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "00E3D80A-849E-4739-8905-373AE0C0189D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "70B52763-5940-4249-BEB4-C14C008DA48E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "BEB65A10-EE74-43DF-8D05-B39551F57D2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:2007:*:*:*:*:*:*:*", "matchCriteriaId": "A04B4977-F5C0-4438-BBB2-541A3221082D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:rational_clearquest:2008:*:*:*:*:*:*:*", "matchCriteriaId": "900B37B1-944F-4B18-97AD-E4696F6E4F1D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors."}, {"lang": "es", "value": "La interfaz web (tambi\u00e9n conocida como CQWeb) de IBM Rational ClearQuest antes de v7.1.1 no gestiona adecuadamente el uso de URLs antiguas de conexi\u00f3n autom\u00e1tica, lo que podr\u00eda \r\npermitir descubrir las contrase\u00f1as de cuentas de usuario los atacantes remotos mediante vectores no especificados."}], "id": "CVE-2009-4357", "lastModified": "2026-06-16T23:13:30.903", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-12-18T19:30:00.593", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37811"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1023370"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/37385"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/3580"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37811"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1023370"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/37385"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/3580"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}