PatchSiren cyber security CVE debrief
CVE-2017-1128 IBM CVE debrief
CVE-2017-1128 is a cross-site scripting vulnerability in IBM Rational DOORS Next Generation and related Rational Requirements Composer releases. The issue lets a user embed arbitrary JavaScript in the web UI, which can alter intended application behavior and may expose credentials within a trusted session. The record was published on 2017-02-08 and later modified in NVD without changing the original disclosure date.
- Vendor
- IBM
- Product
- Rational Requirements Composer
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-08
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-08
- Advisory updated
- 2026-05-13
Who should care
Organizations running IBM Rational DOORS Next Generation 4.0, 5.0, or 6.0, and IBM Rational Requirements Composer 4.0.x releases should treat this as relevant, especially if users rely on the web UI for collaboration or requirement management. Administrators, application owners, and security teams should verify whether any affected versions are deployed.
Technical summary
NVD classifies the weakness as CWE-79 (cross-site scripting) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The supplied description indicates that arbitrary JavaScript can be embedded in the web UI, enabling attacker-controlled script execution in a trusted browser session. The reported impact is limited confidentiality and integrity impact, with no availability impact indicated.
Defensive priority
Medium. This is an important web application input-handling flaw with user-interaction requirements and limited scope, but it can still expose session data or manipulate application behavior for affected users.
Recommended defensive actions
- Confirm whether IBM Rational DOORS Next Generation or Rational Requirements Composer versions listed by NVD are in use.
- Review the IBM PSIRT advisory and apply the vendor patch or mitigation referenced there.
- Treat any user-generated content or web UI fields in the affected product as untrusted until patched.
- If immediate patching is not possible, reduce exposure by limiting access to the application and restricting who can submit content into affected UI paths.
- Monitor for unusual script execution behavior or browser-side anomalies in affected user sessions.
Evidence notes
All statements above are derived from the supplied NVD record and its references. The vulnerability is identified as CWE-79 with the CVSS vector provided in the source item metadata. A vendor advisory and patch reference are listed by IBM PSIRT at http://www.ibm.com/support/docview.wss?uid=swg21996645, and a third-party advisory entry is listed at http://www.securityfocus.com/bid/96017. The supplied corpus does not include patch version details beyond the affected CPE ranges.
Sources and references
Verified primary and authoritative sources
-
CVE-2017-1128 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2017-1128
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2017-1128 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2017-1128
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.