{"api_version":"1","generated_at":"2026-07-23T04:54:40+00:00","cve":"CVE-2011-4819","urls":{"html":"https://cve.report/CVE-2011-4819","api":"https://cve.report/api/cve/CVE-2011-4819.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-4819","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-4819"},"summary":{"title":"CVE-2011-4819","description":"Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/.","state":"PUBLISHED","assigner":"ibm","published_at":"2012-03-13 03:12:26","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/48299","name":"http://secunia.com/advisories/48299","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA48299 - IBM Maximo Asset Management Products Weakness and Multiple Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/52333","name":"http://www.securityfocus.com/bid/52333","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"inode/x-empty","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21584666","name":"http://www.ibm.com/support/docview.wss?uid=swg21584666","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Vulnerabilities Addressed in Asset and Service Mgmt","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72008","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72008","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09202","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09202","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4819","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4819","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"4819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management","cpe6":"6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management","cpe6":"7.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management_essentials","cpe6":"6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management_essentials","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_asset_management_essentials","cpe6":"7.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:16:35.046Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21584666"},{"name":"maximo-uisesionid-xss(72008)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72008"},{"name":"48299","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/48299"},{"name":"52333","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/52333"},{"name":"IV09202","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09202"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-02-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-01-09T17:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21584666"},{"name":"maximo-uisesionid-xss(72008)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72008"},{"name":"48299","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/48299"},{"name":"52333","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/52333"},{"name":"IV09202","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09202"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2011-4819","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.ibm.com/support/docview.wss?uid=swg21584666","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21584666"},{"name":"maximo-uisesionid-xss(72008)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72008"},{"name":"48299","refsource":"SECUNIA","url":"http://secunia.com/advisories/48299"},{"name":"52333","refsource":"BID","url":"http://www.securityfocus.com/bid/52333"},{"name":"IV09202","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV09202"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2011-4819","datePublished":"2012-03-13T01:00:00.000Z","dateReserved":"2011-12-14T00:00:00.000Z","dateUpdated":"2024-08-07T00:16:35.046Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-03-13 03:12:26","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management:6.2:*:*:*:*:*:*:*","matchCriteriaId":"F540E9A3-A1D7-4993-9149-295970944355"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management:7.1:*:*:*:*:*:*:*","matchCriteriaId":"DE721CF9-0F75-410B-A0F4-542041E25925"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*","matchCriteriaId":"1AEBAE48-FFD0-4837-AB3B-F6C31B1AC8D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management_essentials:6.2:*:*:*:*:*:*:*","matchCriteriaId":"233B2CD5-98F7-4024-BC1E-38BC4D8BA6F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:*:*:*:*:*:*:*","matchCriteriaId":"85457F6C-80FE-4E9F-BAB6-58B0485D8B7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:*","matchCriteriaId":"598EAB6C-7D41-46FE-BB32-D31014CA01D6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"4819","Ordinal":"1","Title":"CVE-2011-4819","CVE":"CVE-2011-4819","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"4819","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/.","Type":"Description","Title":"CVE-2011-4819"},{"CveYear":"2011","CveId":"4819","Ordinal":"2","NoteData":"2012-03-12","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"4819","Ordinal":"3","NoteData":"2018-01-09","Type":"Other","Title":"Modified"}]}}}