Security readout for executives and security teams
Plain-English summary
This is a stored cross-site scripting issue in IBM Engineering Lifecycle Optimization - Publishing and related IBM lifecycle products. An authenticated user could place JavaScript into the web interface. If another user views it in a trusted session, the script could alter page behavior and potentially expose credentials.
Executive priority
Treat this as a moderate-priority enterprise application risk. It is not reported as actively exploited in the supplied sources, but it can affect trusted engineering workflows and credentials. Remediate in the normal patch cycle, faster for internet-facing or partner-accessible environments.
Technical view
CVE-2020-4977 is a network-reachable stored XSS vulnerability requiring low privileges and user interaction. The CVSS 3.0 score is 5.4. The source data reports confidentiality and integrity impact, changed scope, no availability impact, and IBM X-Force ID 192470.
Likely exposure
Exposure is most likely in organizations running the listed IBM Rational, Engineering Lifecycle Management, Engineering Test Management, or Engineering Lifecycle Optimization versions with authenticated web UI access. Risk increases where external partners, contractors, or broad internal user groups can create or edit content viewed by higher-privileged users.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires an authenticated user to store malicious script content and another user to interact with the affected UI. The main concern is credential disclosure or action manipulation inside a trusted session.
Researcher notes
The source bundle does not list a CWE. The CVSS vector is CVSS:3.0/PR:L/AV:N/I:L/A:N/UI:R/AC:L/S:C/C:L/RL:O/E:H/RC:C. Product naming spans older Rational and newer Engineering Lifecycle brands, so asset mapping should account for renamed or bundled deployments.
Mitigation direction
- Check IBM support guidance for the official remediation or fixed versions.
- Inventory all affected IBM lifecycle products and versions listed in the advisory.
- Prioritize remediation where the web UI is reachable by broad user populations.
- Restrict write access to trusted users until vendor remediation is applied.
- Monitor for suspicious stored content or unexpected UI behavior.
Validation and detection
- Confirm deployed product names and versions against the affected version list.
- Verify whether IBM Engineering Lifecycle Optimization - Publishing is installed or enabled.
- Check whether affected web interfaces are reachable by authenticated non-admin users.
- Review vulnerability scan results for stored XSS findings in affected IBM components.
- Confirm remediation status against IBM advisory guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-4977 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/PR:L/AV:N/I:L/A:N/UI:R/AC:L/S:C/C:L/RL:O/E:H/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/PR:L/AV:N/I:L/A:N/UI:R/AC:L/S:C/C:L/RL:O/E:H/RC:C2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.4MediumVector: CVSS:3.0/PR:L/AV:N/I:L/A:N/UI:R/AC:L/S:C/C:L/RL:O/E:H/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/6457739CVE reference · x_refsource_CONFIRM
- ibm-engineering-cve20204977-xss (192470)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.