CVE-2014-3026
Summary
| CVE | CVE-2014-3026 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-07-29 20:55:08 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. |
Risk And Classification
Primary CVSS: v2.0 3.5 from [email protected]
AV:N/AC:M/Au:S/C:N/I:P/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:S/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Maximo Asset Management | 7.5.0.0 | All | All | All |
| Application | Ibm | Maximo Asset Management | 7.5.0.1 | All | All | All |
| Application | Ibm | Maximo Asset Management | 7.5.0.2 | All | All | All |
| Application | Ibm | Maximo Asset Management | 7.5.0.3 | All | All | All |
| Application | Ibm | Maximo Asset Management | 7.5.0.4 | All | All | All |
| Application | Ibm | Maximo Asset Management | 7.5.0.5 | All | All | All |
| Application | Ibm | Maximo Asset Management | 7.5.0.6 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.0 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.1 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.2 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.3 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.4 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.5 | All | All | All |
| Application | Ibm | Maximo Asset Management Essentials | 7.5.0.6 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.0 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.1 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.2 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.3 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.4 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.5 | All | All | All |
| Application | Ibm | Maximo Industry Solutions | 7.5.0.6 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.0.0 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.0.1 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.0.2 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.0.3 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.1.0 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.1.1 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.1.2 | All | All | All |
| Application | Ibm | Smartcloud Control Desk | 7.5.1.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Bulletin: HTTP Header Injection Vulnerability Addressed in Asset and Service Management (CVE-2014-3026) | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.