IBM Maximo Asset Management CVE-2019-4364 Remote Command Execution Vulnerability

Bugtraq ID:	108910
Class:	Input Validation Error
CVE:	CVE-2019-4364
Remote:	Yes
Local:	No
Published:	Jun 12 2019 12:00AM
Updated:	Jun 12 2019 12:00AM
Credit:	IBM.
Vulnerable:	IBM Tivoli Integration Composer 0 IBM SmartCloud Control Desk 0 IBM Maximo for Utilities 0 IBM Maximo for Transportation 0 IBM Maximo for Oil and Gas 0 IBM Maximo for Nuclear Power 0 IBM Maximo for Life Sciences 0 IBM Maximo for Aviation 0 IBM Maximo Asset Management 7.6 IBM Control Desk 0
Not Vulnerable:	IBM Maximo Asset Management 7.6.1.1 IBM Maximo Asset Management 7.6.1.0 IBM Maximo Asset Management 7.6.0.10

IBM Maximo Asset Management CVE-2019-4364 Remote Command Execution Vulnerability

IBM Maximo Asset Management is prone to a remote command-execution vulnerability because it fails to properly sanitize user-supplied files.

An attacker can exploit this issue to execute arbitrary command on the affected system. This may aid in further attacks.

IBM Maximo Asset Management 7.6 is vulnerable.

IBM Maximo Asset Management CVE-2019-4364 Remote Command Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Maximo Asset Management CVE-2019-4364 Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Maximo Asset Management CVE-2019-4364 Remote Command Execution Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: IBM Maximo Asset Management is vulnerable to CSV Injection (C (IBM)