Vulnerability-Lookup - Search a vulnerability

CVE-2019-4749 (GCVE-0-2019-4749)

Vulnerability from cvelistv5

Published

2020-04-17 13:25

Modified

2024-09-17 03:22

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C

CWE

Cross-Site Scripting

Summary

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308.

References

►

URL

Tags

	https://www.ibm.com/support/pages/node/6193479	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/173308	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Maximo Asset Management	Version: 7.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:40:49.060Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6193479"
          },
          {
            "name": "ibm-maximo-cve20194749-xss (173308)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/173308"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maximo Asset Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6"
            }
          ]
        }
      ],
      "datePublic": "2020-04-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 5.2,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/PR:L/UI:R/AV:N/A:N/AC:L/C:L/I:L/S:C/RC:C/RL:O/E:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-Site Scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-17T13:25:26",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6193479"
        },
        {
          "name": "ibm-maximo-cve20194749-xss (173308)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/173308"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2020-04-16T00:00:00",
          "ID": "CVE-2019-4749",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Maximo Asset Management",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "L",
              "I": "L",
              "PR": "L",
              "S": "C",
              "UI": "R"
            },
            "TM": {
              "E": "H",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-Site Scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6193479",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6193479 (Maximo Asset Management)",
              "url": "https://www.ibm.com/support/pages/node/6193479"
            },
            {
              "name": "ibm-maximo-cve20194749-xss (173308)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/173308"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2019-4749",
    "datePublished": "2020-04-17T13:25:26.685011Z",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-09-17T03:22:52.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-4409 (GCVE-0-2020-4409)

Vulnerability from cvelistv5

Published

2020-09-16 15:55

Modified

2024-09-16 17:59

Severity ?

6.8 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C

CWE

Gain Access

Summary

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537.

References

►

URL

Tags

	https://www.ibm.com/support/pages/node/6333091	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/179537	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Maximo Asset Management	Version: 7.6.0 Version: 7.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:00:07.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6333091"
          },
          {
            "name": "ibm-maximo-cve20204409-gain-access (179537)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179537"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maximo Asset Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0"
            },
            {
              "status": "affected",
              "version": "7.6.1"
            }
          ]
        }
      ],
      "datePublic": "2020-09-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/PR:L/C:N/UI:R/I:H/A:N/AC:L/S:C/AV:N/E:U/RL:O/RC:C",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Gain Access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-16T15:55:14",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6333091"
        },
        {
          "name": "ibm-maximo-cve20204409-gain-access (179537)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179537"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2020-09-15T00:00:00",
          "ID": "CVE-2020-4409",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Maximo Asset Management",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.6.0"
                          },
                          {
                            "version_value": "7.6.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "N",
              "I": "H",
              "PR": "L",
              "S": "C",
              "UI": "R"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Gain Access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6333091",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6333091 (Maximo Asset Management)",
              "url": "https://www.ibm.com/support/pages/node/6333091"
            },
            {
              "name": "ibm-maximo-cve20204409-gain-access (179537)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179537"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2020-4409",
    "datePublished": "2020-09-16T15:55:14.429944Z",
    "dateReserved": "2019-12-30T00:00:00",
    "dateUpdated": "2024-09-16T17:59:43.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-4650 (GCVE-0-2020-4650)

Vulnerability from cvelistv5

Published

2020-11-09 20:25

Modified

2024-09-17 02:32

Severity ?

4.0 (Medium) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CWE

Obtain Information

Summary

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.

References

►

URL

Tags

	https://www.ibm.com/support/pages/node/6361769	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/186023	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Maximo Spatial Asset Management	Version: 7.6.0.3 Version: 7.6.0.4 Version: 7.6.0.5 Version: 7.6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:07:49.121Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6361769"
          },
          {
            "name": "ibm-maximo-cve20204650-info-disc (186023)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186023"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maximo Spatial Asset Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0.3"
            },
            {
              "status": "affected",
              "version": "7.6.0.4"
            },
            {
              "status": "affected",
              "version": "7.6.0.5"
            },
            {
              "status": "affected",
              "version": "7.6.1.0"
            }
          ]
        }
      ],
      "datePublic": "2020-11-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 3.5,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/PR:N/UI:N/I:N/A:N/C:L/AC:L/S:U/RC:C/E:U/RL:O",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-09T20:25:17",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6361769"
        },
        {
          "name": "ibm-maximo-cve20204650-info-disc (186023)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186023"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2020-11-06T00:00:00",
          "ID": "CVE-2020-4650",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Maximo Spatial Asset Management",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.6.0.3"
                          },
                          {
                            "version_value": "7.6.0.4"
                          },
                          {
                            "version_value": "7.6.0.5"
                          },
                          {
                            "version_value": "7.6.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "L",
              "C": "L",
              "I": "N",
              "PR": "N",
              "S": "U",
              "UI": "N"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6361769",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6361769 (Maximo Spatial Asset Management)",
              "url": "https://www.ibm.com/support/pages/node/6361769"
            },
            {
              "name": "ibm-maximo-cve20204650-info-disc (186023)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186023"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2020-4650",
    "datePublished": "2020-11-09T20:25:17.430354Z",
    "dateReserved": "2019-12-30T00:00:00",
    "dateUpdated": "2024-09-17T02:32:29.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-4644 (GCVE-0-2019-4644)

Vulnerability from cvelistv5

Published

2020-04-17 13:25

Modified

2024-09-16 19:01

Severity ?

6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C

CWE

Cross-Site Scripting

Summary

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880.

References

►

URL

Tags

	https://www.ibm.com/support/pages/node/6191583	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/170880	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Maximo Asset Management	Version: 7.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:40:47.976Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6191583"
          },
          {
            "name": "ibm-maximo-cve20194644-xss (170880)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/170880"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maximo Asset Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6"
            }
          ]
        }
      ],
      "datePublic": "2020-04-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 5.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AC:L/C:L/S:C/I:L/A:N/PR:N/UI:R/AV:N/E:H/RL:O/RC:C",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-Site Scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-17T13:25:26",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6191583"
        },
        {
          "name": "ibm-maximo-cve20194644-xss (170880)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/170880"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2020-04-16T00:00:00",
          "ID": "CVE-2019-4644",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Maximo Asset Management",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "L",
              "I": "L",
              "PR": "N",
              "S": "C",
              "UI": "R"
            },
            "TM": {
              "E": "H",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-Site Scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6191583",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6191583 (Maximo Asset Management)",
              "url": "https://www.ibm.com/support/pages/node/6191583"
            },
            {
              "name": "ibm-maximo-cve20194644-xss (170880)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/170880"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2019-4644",
    "datePublished": "2020-04-17T13:25:26.254254Z",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-09-16T19:01:05.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-4651 (GCVE-0-2020-4651)

Vulnerability from cvelistv5

Published

2020-11-09 20:25

Modified

2024-09-17 03:27

Severity ?

4.8 (Medium) - CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

CWE

Gain Access

Summary

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.

References

►

URL

Tags

	https://www.ibm.com/support/pages/node/6361767	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/186024	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Maximo Spatial Asset Management	Version: 7.6.0.3 Version: 7.6.0.4 Version: 7.6.0.5 Version: 7.6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:07:49.109Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6361767"
          },
          {
            "name": "ibm-maximo-cve20204651-csrf (186024)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186024"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maximo Spatial Asset Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0.3"
            },
            {
              "status": "affected",
              "version": "7.6.0.4"
            },
            {
              "status": "affected",
              "version": "7.6.0.5"
            },
            {
              "status": "affected",
              "version": "7.6.1.0"
            }
          ]
        }
      ],
      "datePublic": "2020-11-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.2,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/I:H/UI:R/AV:A/PR:N/S:U/A:N/AC:H/C:N/E:U/RC:C/RL:O",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Gain Access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-09T20:25:17",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6361767"
        },
        {
          "name": "ibm-maximo-cve20204651-csrf (186024)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186024"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2020-11-06T00:00:00",
          "ID": "CVE-2020-4651",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Maximo Spatial Asset Management",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.6.0.3"
                          },
                          {
                            "version_value": "7.6.0.4"
                          },
                          {
                            "version_value": "7.6.0.5"
                          },
                          {
                            "version_value": "7.6.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "H",
              "AV": "A",
              "C": "N",
              "I": "H",
              "PR": "N",
              "S": "U",
              "UI": "R"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Gain Access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6361767",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6361767 (Maximo Spatial Asset Management)",
              "url": "https://www.ibm.com/support/pages/node/6361767"
            },
            {
              "name": "ibm-maximo-cve20204651-csrf (186024)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186024"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2020-4651",
    "datePublished": "2020-11-09T20:25:17.867284Z",
    "dateReserved": "2019-12-30T00:00:00",
    "dateUpdated": "2024-09-17T03:27:35.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd

Published

2020-04-17 14:15

Modified

2024-11-21 04:43

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880.

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/170880	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/6191583	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/170880	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/6191583	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	control_desk	7.6.1
ibm	control_desk	7.6.1.1
ibm	maximo_asset_configuration_manager	7.6.6
ibm	maximo_asset_configuration_manager	7.6.7
ibm	maximo_asset_configuration_manager	7.6.7.1
ibm	maximo_asset_health_insights	7.6.1
ibm	maximo_asset_health_insights	7.6.1.1
ibm	maximo_asset_management	7.6.1.1
ibm	maximo_asset_management_scheduler	7.6.7
ibm	maximo_asset_management_scheduler	7.6.7.1
ibm	maximo_asset_management_scheduler	7.6.7.3
ibm	maximo_asset_management_scheduler_plus	7.6.7
ibm	maximo_asset_management_scheduler_plus	7.6.7.1
ibm	maximo_asset_management_scheduler_plus	7.6.7.3
ibm	maximo_calibration	7.6
ibm	maximo_enterprise_adapter	7.6
ibm	maximo_enterprise_adapter	7.6.1
ibm	maximo_equipment_maintenance_assistant	-
ibm	maximo_for_aviation	7.6.6
ibm	maximo_for_aviation	7.6.7
ibm	maximo_for_aviation	7.6.8
ibm	maximo_for_life_sciences	7.6
ibm	maximo_for_nuclear_power	7.6.1
ibm	maximo_for_oil_and_gas	7.6.1
ibm	maximo_for_service_providers	7.6.3.1
ibm	maximo_for_service_providers	7.6.3.2
ibm	maximo_for_service_providers	7.6.3.3
ibm	maximo_for_transportation	7.6.2.3
ibm	maximo_for_transportation	7.6.2.4
ibm	maximo_for_transportation	7.6.2.5
ibm	maximo_for_utilities	7.6.0.1
ibm	maximo_for_utilities	7.6.0.2
ibm	maximo_linear_asset_manager	7.6.0.1
ibm	maximo_linear_asset_manager	7.6.0.2
ibm	maximo_linear_asset_manager	7.6.0.3
ibm	maximo_network_on_blockchain	7.6.0.0
ibm	maximo_network_on_blockchain	7.6.0.1
ibm	maximo_spatial_asset_management	7.6.0.2
ibm	maximo_spatial_asset_management	7.6.0.3
ibm	maximo_spatial_asset_management	7.6.0.4
ibm	maximo_spatial_asset_management	7.6.0.5
ibm	tivoli_integration_composer	7.6

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:control_desk:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA7D6830-74DA-4524-8177-54CB2667A54E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:control_desk:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE7C8399-A024-45CE-A2CD-658A2D99ABDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "830412EF-C21D-4455-9396-06222B32F61E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B9EA821-8DC7-4D08-B516-CA8D0692DD29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "31FDF238-C29E-4F15-AB54-C90226BC0A69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA8E3FBA-9DBB-487E-99AD-5E1119150D73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4989C34-4B4E-4E53-A13E-13667DCBB19D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5CE3F4-8ABE-4245-BD9E-8697B3E0171C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDD061C9-2D80-48CF-B660-68948B03F3C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "28402BF3-15EC-41F5-AD53-EC196CF3F345",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "81A99155-0D86-4998-AC74-2FECE3AF277F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "69E511EF-7DE6-42CA-848C-E0FF2D04AB19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5021AA5-A4D4-4E5F-85A8-CFF038EBD9F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B80B0192-3ECE-4B44-B060-F6CE54A744C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_calibration:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "768BB000-6ED2-4289-8BCA-66981EC95BB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2A20FB3-C352-4F5C-BD5A-5814BBA837DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8C2AB76-29C5-46BD-ABAD-37913D3A4675",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_equipment_maintenance_assistant:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEED2F57-E98D-479E-8303-2188AFA0C70B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "4317DA0E-678D-468F-8BE4-8BA20C01C588",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DB202BE-FF6E-49AC-84FF-F454361E5D4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "C05DA047-26F7-413E-8259-5F88C08AE2B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BA294D6-4D4D-4ADB-A05B-F578A8877A4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_nuclear_power:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "532219AE-9F4D-49B0-A625-A690C9E8A7DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "160EE7B0-4F54-41F7-9266-C22776783BA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "19405179-FDEF-4207-B12F-C39D49B49F12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FBE6121-5166-4C7A-B4BA-4D5F46720EC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F66129CF-729D-4120-912E-E8109CF1E237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "36062812-7AD2-4908-94BA-B06CA4503CB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC89A6D2-20D5-4066-8F35-2936C6D0C0A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BDF6664-537E-4CF8-9CCA-7C4746DE9B08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F416A57-7B00-411D-B2D5-5BCB434568DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "73EEADC8-01D0-4D80-83E4-1643603485CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "45C84F5F-C612-4A0A-AD91-A4335496E934",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C32832CB-63FC-4F9E-81A4-3A8CE2F98319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D23F86AC-2C39-42DC-83EF-3BA2DBF99A1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E6CFC29-9FD2-4BE5-9A66-6FA6F94C0D7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BC0DF05-9B84-45B8-924E-E4CB672F7C45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D799591-F5D0-4B17-AE32-ABED616A65AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "095BBF20-1C8F-4FBC-8D72-3A3DB5A3F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B3B2C5-E8D0-48A1-9837-40A627D7E742",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E59EA84-F607-404B-A392-7D68C5672B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:tivoli_integration_composer:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "21C989DE-2E87-4941-B0DA-9381964E2292",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880."
    },
    {
      "lang": "es",
      "value": "IBM Maximo Asset Management versi\u00f3n 7.6, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista, conllevando a una divulgaci\u00f3n de credenciales en una sesi\u00f3n confiable. IBM X-Force ID: 170880."
    }
  ],
  "id": "CVE-2019-4644",
  "lastModified": "2024-11-21T04:43:54.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-17T14:15:17.833",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/170880"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6191583"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/170880"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6191583"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2020-11-09 21:15

Modified

2024-11-21 05:33

Severity ?

4.8 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/186024	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/6361767	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/186024	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/6361767	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	maximo_spatial_asset_management	7.6.0.3
ibm	maximo_spatial_asset_management	7.6.0.4
ibm	maximo_spatial_asset_management	7.6.0.5
ibm	maximo_spatial_asset_management	7.6.1.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "095BBF20-1C8F-4FBC-8D72-3A3DB5A3F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B3B2C5-E8D0-48A1-9837-40A627D7E742",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E59EA84-F607-404B-A392-7D68C5672B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA3A07B8-2275-470D-AD53-4539A4F3AE70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024."
    },
    {
      "lang": "es",
      "value": "IBM Maximo Spatial Asset Management versiones 7.6.0.3, 7.6.0.4, 7.6.0.5 y 7.6.1.0, es vulnerable a un ataque de tipo cross-site request forgery, lo que podr\u00eda permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario en el que conf\u00eda el sitio web.\u0026#xa0; IBM X-Force ID: 186024"
    }
  ],
  "id": "CVE-2020-4651",
  "lastModified": "2024-11-21T05:33:02.983",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.5,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-11-09T21:15:12.917",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186024"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6361767"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6361767"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2020-11-09 21:15

Modified

2024-11-21 05:33

Severity ?

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/186023	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/6361769	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/186023	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/6361769	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	maximo_spatial_asset_management	7.6.0.3
ibm	maximo_spatial_asset_management	7.6.0.4
ibm	maximo_spatial_asset_management	7.6.0.5
ibm	maximo_spatial_asset_management	7.6.1.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "095BBF20-1C8F-4FBC-8D72-3A3DB5A3F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B3B2C5-E8D0-48A1-9837-40A627D7E742",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E59EA84-F607-404B-A392-7D68C5672B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA3A07B8-2275-470D-AD53-4539A4F3AE70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023."
    },
    {
      "lang": "es",
      "value": "IBM Maximo Spatial Asset Management versiones 7.6.0.3, 7.6.0.4, 7.6.0.5 y 7.6.1.0, permite que las p\u00e1ginas web sean almacenadas localmente las cuales puedan ser le\u00eddas por otro usuario en el sistema. IBM X-Force ID: 186023"
    }
  ],
  "id": "CVE-2020-4650",
  "lastModified": "2024-11-21T05:33:02.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 1.4,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-11-09T21:15:12.777",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186023"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6361769"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186023"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6361769"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-922"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2020-09-16 16:15

Modified

2024-11-21 05:32

Severity ?

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Summary

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537.

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/179537	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/6333091	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/179537	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/6333091	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	control_desk	7.6.1
ibm	control_desk	7.6.1.1
ibm	maximo_asset_configuration_manager	7.6.6
ibm	maximo_asset_configuration_manager	7.6.7
ibm	maximo_asset_configuration_manager	7.6.7.1
ibm	maximo_asset_health_insights	7.6.1
ibm	maximo_asset_health_insights	7.6.1.1
ibm	maximo_asset_management	*
ibm	maximo_asset_management_scheduler	7.6.7
ibm	maximo_asset_management_scheduler	7.6.7.1
ibm	maximo_asset_management_scheduler	7.6.7.3
ibm	maximo_asset_management_scheduler_plus	7.6.7
ibm	maximo_asset_management_scheduler_plus	7.6.7.1
ibm	maximo_asset_management_scheduler_plus	7.6.7.3
ibm	maximo_calibration	7.6
ibm	maximo_enterprise_adapter	7.6
ibm	maximo_enterprise_adapter	7.6.1
ibm	maximo_equipment_maintenance_assistant	-
ibm	maximo_for_aviation	7.6.6
ibm	maximo_for_aviation	7.6.7
ibm	maximo_for_aviation	7.6.8
ibm	maximo_for_life_sciences	7.6
ibm	maximo_for_nuclear_power	7.6.1
ibm	maximo_for_oil_and_gas	7.6.1
ibm	maximo_for_service_providers	7.6.3.1
ibm	maximo_for_service_providers	7.6.3.2
ibm	maximo_for_service_providers	7.6.3.3
ibm	maximo_for_transportation	7.6.2.3
ibm	maximo_for_transportation	7.6.2.4
ibm	maximo_for_transportation	7.6.2.5
ibm	maximo_for_utilities	7.6.0.1
ibm	maximo_for_utilities	7.6.0.2
ibm	maximo_linear_asset_manager	7.6.0
ibm	maximo_linear_asset_manager	7.6.0.2
ibm	maximo_linear_asset_manager	7.6.0.3
ibm	maximo_network_on_blockchain	7.6.0.0
ibm	maximo_network_on_blockchain	7.6.0.1
ibm	maximo_spatial_asset_management	7.6.0.2
ibm	maximo_spatial_asset_management	7.6.0.3
ibm	maximo_spatial_asset_management	7.6.0.4
ibm	maximo_spatial_asset_management	7.6.0.5
ibm	tivoli_integration_composer	7.6

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:control_desk:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA7D6830-74DA-4524-8177-54CB2667A54E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:control_desk:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE7C8399-A024-45CE-A2CD-658A2D99ABDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "830412EF-C21D-4455-9396-06222B32F61E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B9EA821-8DC7-4D08-B516-CA8D0692DD29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "31FDF238-C29E-4F15-AB54-C90226BC0A69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA8E3FBA-9DBB-487E-99AD-5E1119150D73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4989C34-4B4E-4E53-A13E-13667DCBB19D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "63D81A1F-4A22-4DAD-B5BE-EA825DF9C4CB",
              "versionEndExcluding": "7.6.1.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDD061C9-2D80-48CF-B660-68948B03F3C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "28402BF3-15EC-41F5-AD53-EC196CF3F345",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "81A99155-0D86-4998-AC74-2FECE3AF277F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "69E511EF-7DE6-42CA-848C-E0FF2D04AB19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5021AA5-A4D4-4E5F-85A8-CFF038EBD9F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B80B0192-3ECE-4B44-B060-F6CE54A744C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_calibration:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "768BB000-6ED2-4289-8BCA-66981EC95BB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2A20FB3-C352-4F5C-BD5A-5814BBA837DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8C2AB76-29C5-46BD-ABAD-37913D3A4675",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_equipment_maintenance_assistant:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEED2F57-E98D-479E-8303-2188AFA0C70B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "4317DA0E-678D-468F-8BE4-8BA20C01C588",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DB202BE-FF6E-49AC-84FF-F454361E5D4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "C05DA047-26F7-413E-8259-5F88C08AE2B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BA294D6-4D4D-4ADB-A05B-F578A8877A4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_nuclear_power:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "532219AE-9F4D-49B0-A625-A690C9E8A7DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "160EE7B0-4F54-41F7-9266-C22776783BA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "19405179-FDEF-4207-B12F-C39D49B49F12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FBE6121-5166-4C7A-B4BA-4D5F46720EC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F66129CF-729D-4120-912E-E8109CF1E237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "36062812-7AD2-4908-94BA-B06CA4503CB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC89A6D2-20D5-4066-8F35-2936C6D0C0A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BDF6664-537E-4CF8-9CCA-7C4746DE9B08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F416A57-7B00-411D-B2D5-5BCB434568DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "73EEADC8-01D0-4D80-83E4-1643603485CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7240562-D72E-4D3E-B392-3FB870320B60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C32832CB-63FC-4F9E-81A4-3A8CE2F98319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D23F86AC-2C39-42DC-83EF-3BA2DBF99A1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E6CFC29-9FD2-4BE5-9A66-6FA6F94C0D7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BC0DF05-9B84-45B8-924E-E4CB672F7C45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D799591-F5D0-4B17-AE32-ABED616A65AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "095BBF20-1C8F-4FBC-8D72-3A3DB5A3F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B3B2C5-E8D0-48A1-9837-40A627D7E742",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E59EA84-F607-404B-A392-7D68C5672B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:tivoli_integration_composer:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "21C989DE-2E87-4941-B0DA-9381964E2292",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537."
    },
    {
      "lang": "es",
      "value": "IBM Maximo Asset Management versiones 7.6.0 y 7.6.1, podr\u00edan permitir a un atacante remoto conducir ataques de phishing usando un ataque de tabnabbing.\u0026#xa0;Al persuadir a una v\u00edctima de visitar un sitio web especialmente dise\u00f1ado, un atacante remoto podr\u00eda explotar esta vulnerabilidad para redireccionar a un usuario a un sitio web malicioso que parecer\u00eda ser confiable.\u0026#xa0;Esto podr\u00eda permitir a un atacante obtener informaci\u00f3n altamente confidencial o conducir nuevos ataques contra la v\u00edctima.\u0026#xa0;IBM X-Force ID: 179537"
    }
  ],
  "id": "CVE-2020-4409",
  "lastModified": "2024-11-21T05:32:42.300",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-16T16:15:15.030",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179537"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6333091"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179537"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6333091"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2020-04-17 14:15

Modified

2024-11-21 04:44

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308.

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/173308	VDB Entry, Vendor Advisory
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/6193479	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/173308	VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/6193479	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	control_desk	7.6.1
ibm	control_desk	7.6.1.1
ibm	maximo_asset_configuration_manager	7.6.6
ibm	maximo_asset_configuration_manager	7.6.7
ibm	maximo_asset_configuration_manager	7.6.7.1
ibm	maximo_asset_health_insights	7.6.1
ibm	maximo_asset_health_insights	7.6.1.1
ibm	maximo_asset_management	7.6.1.1
ibm	maximo_asset_management_scheduler	7.6.7
ibm	maximo_asset_management_scheduler	7.6.7.1
ibm	maximo_asset_management_scheduler	7.6.7.3
ibm	maximo_asset_management_scheduler_plus	7.6.7
ibm	maximo_asset_management_scheduler_plus	7.6.7.1
ibm	maximo_asset_management_scheduler_plus	7.6.7.3
ibm	maximo_calibration	7.6
ibm	maximo_enterprise_adapter	7.6
ibm	maximo_enterprise_adapter	7.6.1
ibm	maximo_equipment_maintenance_assistant	-
ibm	maximo_for_aviation	7.6.6
ibm	maximo_for_aviation	7.6.7
ibm	maximo_for_aviation	7.6.8
ibm	maximo_for_life_sciences	7.6
ibm	maximo_for_nuclear_power	7.6.1
ibm	maximo_for_oil_and_gas	7.6.1
ibm	maximo_for_service_providers	7.6.3.1
ibm	maximo_for_service_providers	7.6.3.2
ibm	maximo_for_service_providers	7.6.3.3
ibm	maximo_for_transportation	7.6.2.3
ibm	maximo_for_transportation	7.6.2.4
ibm	maximo_for_transportation	7.6.2.5
ibm	maximo_for_utilities	7.6.0.1
ibm	maximo_for_utilities	7.6.0.2
ibm	maximo_linear_asset_manager	7.6.0.1
ibm	maximo_linear_asset_manager	7.6.0.2
ibm	maximo_linear_asset_manager	7.6.0.3
ibm	maximo_network_on_blockchain	7.6.0.0
ibm	maximo_network_on_blockchain	7.6.0.1
ibm	maximo_spatial_asset_management	7.6.0.2
ibm	maximo_spatial_asset_management	7.6.0.3
ibm	maximo_spatial_asset_management	7.6.0.4
ibm	maximo_spatial_asset_management	7.6.0.5
ibm	tivoli_integration_composer	7.6.0.1
ibm	tivoli_integration_composer	7.6.0.2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:control_desk:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA7D6830-74DA-4524-8177-54CB2667A54E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:control_desk:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE7C8399-A024-45CE-A2CD-658A2D99ABDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "830412EF-C21D-4455-9396-06222B32F61E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B9EA821-8DC7-4D08-B516-CA8D0692DD29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "31FDF238-C29E-4F15-AB54-C90226BC0A69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA8E3FBA-9DBB-487E-99AD-5E1119150D73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4989C34-4B4E-4E53-A13E-13667DCBB19D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5CE3F4-8ABE-4245-BD9E-8697B3E0171C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDD061C9-2D80-48CF-B660-68948B03F3C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "28402BF3-15EC-41F5-AD53-EC196CF3F345",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "81A99155-0D86-4998-AC74-2FECE3AF277F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "69E511EF-7DE6-42CA-848C-E0FF2D04AB19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5021AA5-A4D4-4E5F-85A8-CFF038EBD9F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B80B0192-3ECE-4B44-B060-F6CE54A744C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_calibration:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "768BB000-6ED2-4289-8BCA-66981EC95BB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2A20FB3-C352-4F5C-BD5A-5814BBA837DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8C2AB76-29C5-46BD-ABAD-37913D3A4675",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_equipment_maintenance_assistant:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEED2F57-E98D-479E-8303-2188AFA0C70B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "4317DA0E-678D-468F-8BE4-8BA20C01C588",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DB202BE-FF6E-49AC-84FF-F454361E5D4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_aviation:7.6.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "C05DA047-26F7-413E-8259-5F88C08AE2B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BA294D6-4D4D-4ADB-A05B-F578A8877A4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_nuclear_power:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "532219AE-9F4D-49B0-A625-A690C9E8A7DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "160EE7B0-4F54-41F7-9266-C22776783BA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "19405179-FDEF-4207-B12F-C39D49B49F12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FBE6121-5166-4C7A-B4BA-4D5F46720EC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F66129CF-729D-4120-912E-E8109CF1E237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "36062812-7AD2-4908-94BA-B06CA4503CB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC89A6D2-20D5-4066-8F35-2936C6D0C0A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BDF6664-537E-4CF8-9CCA-7C4746DE9B08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F416A57-7B00-411D-B2D5-5BCB434568DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "73EEADC8-01D0-4D80-83E4-1643603485CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "45C84F5F-C612-4A0A-AD91-A4335496E934",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C32832CB-63FC-4F9E-81A4-3A8CE2F98319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D23F86AC-2C39-42DC-83EF-3BA2DBF99A1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E6CFC29-9FD2-4BE5-9A66-6FA6F94C0D7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BC0DF05-9B84-45B8-924E-E4CB672F7C45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D799591-F5D0-4B17-AE32-ABED616A65AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "095BBF20-1C8F-4FBC-8D72-3A3DB5A3F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B3B2C5-E8D0-48A1-9837-40A627D7E742",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E59EA84-F607-404B-A392-7D68C5672B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:tivoli_integration_composer:7.6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "797807D9-2137-414A-BB28-46DBC0288161",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:tivoli_integration_composer:7.6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8708C64F-7940-46E7-94FB-1D1CF3B864B1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308."
    },
    {
      "lang": "es",
      "value": "IBM Maximo Asset Management versi\u00f3n 7.6, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar c\u00f3digo JavaScript arbitrario en la Interfaz de Usuario Web, alterando as\u00ed la funcionalidad prevista, conllevando potencialmente a una divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n confiable. IBM X-Force ID: 173308."
    }
  ],
  "id": "CVE-2019-4749",
  "lastModified": "2024-11-21T04:44:06.040",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-17T14:15:17.957",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/173308"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6193479"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/173308"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/6193479"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerabilites related to ibm - maximo_spatial_asset_management

CVE-2019-4749 (GCVE-0-2019-4749)

Vulnerability from cvelistv5

CVE-2020-4409 (GCVE-0-2020-4409)

Vulnerability from cvelistv5

CVE-2020-4650 (GCVE-0-2020-4650)

Vulnerability from cvelistv5

CVE-2019-4644 (GCVE-0-2019-4644)

Vulnerability from cvelistv5

CVE-2020-4651 (GCVE-0-2020-4651)

Vulnerability from cvelistv5

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd