What is the CVSS score of CVE-2020-4546?

CVE-2020-4546 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.6%.

Engineering Requirements Management Doors Next CVE-2020-4546

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2020-09-02 psirt@us.ibm.com

XSS IBM Engineering Requirements Management Doors Next Doors Next Rational Quality Manager Rational Team Concert Rational Collaborative Lifecycle Management Rational Doors Next Generation Rational Engineering Lifecycle Manager Engineering Workflow Management Engineering Test Management Eni

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Sep 02, 2020 - 19:15 nvd

MEDIUM 5.4

DescriptionNVD

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.

AnalysisAI

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314. Affected products include: Ibm Doors Next, Ibm Engineering Requirements Management Doors Next, Ibm Engineering Test Management, Ibm Engineering Workflow Management, Ibm Eni.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.