PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-1128 IBM CVE debrief

CVE-2017-1128 is a cross-site scripting vulnerability in IBM Rational DOORS Next Generation and related Rational Requirements Composer releases. The issue lets a user embed arbitrary JavaScript in the web UI, which can alter intended application behavior and may expose credentials within a trusted session. The record was published on 2017-02-08 and later modified in NVD without changing the original disclosure date.

Vendor
IBM
Product
Rational Requirements Composer
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-08
Original CVE updated
2026-05-13
Advisory published
2017-02-08
Advisory updated
2026-05-13

Who should care

Organizations running IBM Rational DOORS Next Generation 4.0, 5.0, or 6.0, and IBM Rational Requirements Composer 4.0.x releases should treat this as relevant, especially if users rely on the web UI for collaboration or requirement management. Administrators, application owners, and security teams should verify whether any affected versions are deployed.

Technical summary

NVD classifies the weakness as CWE-79 (cross-site scripting) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The supplied description indicates that arbitrary JavaScript can be embedded in the web UI, enabling attacker-controlled script execution in a trusted browser session. The reported impact is limited confidentiality and integrity impact, with no availability impact indicated.

Defensive priority

Medium. This is an important web application input-handling flaw with user-interaction requirements and limited scope, but it can still expose session data or manipulate application behavior for affected users.

Recommended defensive actions

  • Confirm whether IBM Rational DOORS Next Generation or Rational Requirements Composer versions listed by NVD are in use.
  • Review the IBM PSIRT advisory and apply the vendor patch or mitigation referenced there.
  • Treat any user-generated content or web UI fields in the affected product as untrusted until patched.
  • If immediate patching is not possible, reduce exposure by limiting access to the application and restricting who can submit content into affected UI paths.
  • Monitor for unusual script execution behavior or browser-side anomalies in affected user sessions.

Evidence notes

All statements above are derived from the supplied NVD record and its references. The vulnerability is identified as CWE-79 with the CVSS vector provided in the source item metadata. A vendor advisory and patch reference are listed by IBM PSIRT at http://www.ibm.com/support/docview.wss?uid=swg21996645, and a third-party advisory entry is listed at http://www.securityfocus.com/bid/96017. The supplied corpus does not include patch version details beyond the affected CPE ranges.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-1128 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-1128

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-1128 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-1128

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.