Security readout for executives and security teams
Plain-English summary
IBM Engineering Requirements Quality Assistant On-Premises is affected by a Web UI cross-site scripting flaw. A logged-in user could place JavaScript into the application, potentially changing page behavior and exposing credentials within a trusted session. The score is medium, but exposure matters if the tool is internet-accessible or broadly used internally.
Executive priority
Treat this as a moderate-priority remediation item. It is not supported as actively exploited by the provided evidence, but it can expose credentials inside trusted sessions and affects all listed on-premises versions.
Technical view
CVE-2021-29788 is a stored or embedded Web UI cross-site scripting issue affecting all versions of IBM Engineering Requirements Quality Assistant On-Premises, per the provided CVE bundle. CVSS is 5.4 with network access, low privileges, low complexity, required user interaction, changed scope, and low confidentiality and integrity impact.
Likely exposure
Organizations running IBM Engineering Requirements Quality Assistant On-Premises are potentially exposed, with the bundle listing all versions as affected. Risk is higher where many users can create or edit UI-visible content, or where access is exposed beyond a tightly controlled internal user base.
Exploitation context
The provided bundle does not establish active exploitation, and KEV is false. The vulnerability requires privileges and user interaction, but successful exploitation could affect a trusted user session and lead to credential disclosure or UI manipulation.
Researcher notes
Evidence is limited to the CVE description, IBM support reference, and IBM X-Force ID 203310. The bundle does not name a specific vulnerable parameter, patch version, or exploit procedure. Avoid assuming product editions beyond IBM Engineering Requirements Quality Assistant On-Premises.
Mitigation direction
- Review IBM advisory 6604005 for official fixes or vendor-directed mitigation.
- Apply IBM-provided updates or workarounds where available.
- Restrict application access to trusted users and networks.
- Limit content-editing permissions to users with a business need.
- Monitor for suspicious script-like content in user-controlled fields.
Validation and detection
- Inventory all IBM Engineering Requirements Quality Assistant On-Premises deployments.
- Confirm installed versions against IBM advisory 6604005.
- Review whether the application is internet-facing or broadly internally accessible.
- Check user roles that can create UI-visible content.
- Review logs and content history for unexpected script-like entries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-29788 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/PR:L/S:C/UI:R/A:N/AV:N/I:L/AC:L/C:L/RC:C/RL:O/E:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/PR:L/S:C/UI:R/A:N/AV:N/I:L/AC:L/C:L/RC:C/RL:O/E:H2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.4MediumVector: CVSS:3.0/PR:L/S:C/UI:R/A:N/AV:N/I:L/AC:L/C:L/RC:C/RL:O/E:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/6604005CVE reference · x_refsource_CONFIRM
- ibm-engineering-cve202129788-xss (203310)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.