Vulnerability CVE-2014-0914
Published: 2014-07-30

Description:
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management for IT and Maximo Service Desk allows remote authenticated users to inject arbitrary web script or HTML via the Query Description Field.

Type:

CWE-79

 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
IBM -> Maximo asset management 
IBM -> Maximo asset management essentials 
IBM -> Maximo for government 
IBM -> Maximo for life sciences 
IBM -> Maximo for nuclear power 
IBM -> Maximo for oil and gas 
IBM -> Maximo for transportation 
IBM -> Maximo for utilities 
IBM -> Maximo service desk 
IBM -> Smartcloud control desk 
IBM -> Tivoli it asset management for it 

 References:
http://secunia.com/advisories/59570
http://secunia.com/advisories/59640
http://www-01.ibm.com/support/docview.wss?uid=swg1IV56679
http://www-01.ibm.com/support/docview.wss?uid=swg21678885
http://www.securityfocus.com/archive/1/533110/100/0/threaded
http://www.securityfocus.com/bid/68839
https://exchange.xforce.ibmcloud.com/vulnerabilities/91883
Copyright 2024, cxsecurity.com

 

Back to Top