{"api_version":"1","generated_at":"2026-07-23T03:11:24+00:00","cve":"CVE-2011-1395","urls":{"html":"https://cve.report/CVE-2011-1395","api":"https://cve.report/api/cve/CVE-2011-1395.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-1395","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-1395"},"summary":{"title":"CVE-2011-1395","description":"Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2012-03-13 03:12:25","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71996","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71996","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/48299","name":"http://secunia.com/advisories/48299","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA48299 - IBM Maximo Asset Management Products Weakness and Multiple Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/52333","name":"http://www.securityfocus.com/bid/52333","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"inode/x-empty","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21584666","name":"http://www.ibm.com/support/docview.wss?uid=swg21584666","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Vulnerabilities Addressed in Asset and Service Mgmt","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1395","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1395","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"1395","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management","cpe6":"6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1395","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1395","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management","cpe6":"7.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1395","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management_essentials","cpe6":"6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1395","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management_essentials","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1395","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management_essentials","cpe6":"7.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T22:28:40.285Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"maximo-imicon-xss(71996)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71996"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21584666"},{"name":"48299","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/48299"},{"name":"52333","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/52333"},{"name":"IV09189","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-02-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-01-09T17:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"maximo-imicon-xss(71996)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71996"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21584666"},{"name":"48299","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/48299"},{"name":"52333","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/52333"},{"name":"IV09189","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-1395","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"maximo-imicon-xss(71996)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71996"},{"name":"http://www.ibm.com/support/docview.wss?uid=swg21584666","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21584666"},{"name":"48299","refsource":"SECUNIA","url":"http://secunia.com/advisories/48299"},{"name":"52333","refsource":"BID","url":"http://www.securityfocus.com/bid/52333"},{"name":"IV09189","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-1395","datePublished":"2012-03-13T01:00:00.000Z","dateReserved":"2011-03-10T00:00:00.000Z","dateUpdated":"2024-08-06T22:28:40.285Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-03-13 03:12:25","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management:6.2:*:*:*:*:*:*:*","matchCriteriaId":"F540E9A3-A1D7-4993-9149-295970944355"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management:7.1:*:*:*:*:*:*:*","matchCriteriaId":"DE721CF9-0F75-410B-A0F4-542041E25925"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*","matchCriteriaId":"1AEBAE48-FFD0-4837-AB3B-F6C31B1AC8D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management_essentials:6.2:*:*:*:*:*:*:*","matchCriteriaId":"233B2CD5-98F7-4024-BC1E-38BC4D8BA6F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:*:*:*:*:*:*:*","matchCriteriaId":"85457F6C-80FE-4E9F-BAB6-58B0485D8B7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:*","matchCriteriaId":"598EAB6C-7D41-46FE-BB32-D31014CA01D6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"1395","Ordinal":"1","Title":"CVE-2011-1395","CVE":"CVE-2011-1395","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"1395","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter.","Type":"Description","Title":"CVE-2011-1395"},{"CveYear":"2011","CveId":"1395","Ordinal":"2","NoteData":"2012-03-12","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"1395","Ordinal":"3","NoteData":"2018-01-09","Type":"Other","Title":"Modified"}]}}}