CVE-2015-5039 describes a critical vulnerability in IBM Rational ClearCase versions 7.1.x, 8.0.0.x (before 8.0.0.18), and 8.0.1.x (before 8.0.1.11). The flaw lies in the Remote Client and change management integrations' failure to properly validate hostnames in X.509 certificates from SSL servers. This allows remote attackers to spoof legitimate servers, potentially leading to sensitive information disclosure or network traffic manipulation via a crafted certificate. The vulnerability carries a CVSSv3 score of 7.4 (HIGH), indicating a significant risk. Its attack vector is network-based with high attack complexity, but requires no user interaction or privileges. Successful exploitation could result in high confidentiality and integrity impacts, though availability is not affected. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or interest.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.1, <= 7.1.2.16CPE matchmatch criteria | cpe:2.3:a:ibm:rational_clearcase:*:*:*:*:*:*:*:* | ||
> 8.0, <= 8.0.0.17CPE matchmatch criteria | cpe:2.3:a:ibm:rational_clearcase:*:*:*:*:*:*:*:* | ||
>= 8.0.1, <= 8.0.1.10CPE matchmatch criteria | cpe:2.3:a:ibm:rational_clearcase:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.