« Back to list

CVE-2008-5327

Status: ModifiedMedium (6.5)—

The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7 before 7.1 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password object within the object tree.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

IBM — Rational Clearquest

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2008-5327",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-12-05T00:30:00.360",
  "references": [
    {
      "url": "http://secunia.com/advisories/32847",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK65908",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46995",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32847",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PK65908",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46995",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7 before 7.1 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password object within the object tree."
    },
    {
      "lang": "es",
      "value": "La herramienta ClearQuest Maintenance en IBM Rational ClearQuest v7 anterior a la v7.1 almacena la contraseña de la base de datos en texto claro en un objeto en un perfil de conexión de ClearQuest o un fichero de exportación, que permitiría a usuarios remotos autenticados obtener información sensible localizando el objeto contraseña en el árbol de objetos."
    }
  ],
  "lastModified": "2026-06-16T22:59:43.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37B059D3-5A21-48FA-8D9D-F0DEB8CBB909"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E60F687F-99A1-43C2-90F8-6F56265A2E63"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "266BE1E1-AD1C-49DD-81C6-4840EE36CDCE"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "676DB969-3FF3-4EFA-8B50-9753BAC80EE6"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8CE6CA8-1504-46FA-8A36-FFDBD1BBE5B6"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EBBBF4D-97FD-4DBC-B296-4235BAD38F61"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00E3D80A-849E-4739-8905-373AE0C0189D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4525242E-6B9A-4F6F-B506-93C92958CA41"
            },
            {
              "criteria": "cpe:2.3:a:ibm:rational_clearquest:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEB65A10-EE74-43DF-8D05-B39551F57D2C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}