IBM Maximo Asset Management Multiple Unspecified Cross Site Scripting Vulnerabilities
BID:58002
Info
IBM Maximo Asset Management Multiple Unspecified Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 58002 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-3322 CVE-2013-0457 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 15 2013 12:00AM |
| Updated: | Feb 15 2013 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Tivoli Service Request Manager 7.2 IBM Tivoli Service Request Manager 7.1 IBM Tivoli Service Request Manager 6.2 IBM Tivoli Asset Management for IT 7.2 IBM Tivoli Asset Management for IT 7.1 IBM Tivoli Asset Management for IT 6.2 IBM SmartCloud Control Desk 7.5 IBM Maximo Asset Management Essentials 7.5 IBM Maximo Asset Management Essentials 7.1 IBM Maximo Asset Management Essentials 6.2 IBM Maximo Asset Management 7.5 IBM Maximo Asset Management 7.1 IBM Maximo Asset Management 6.2 IBM Change and Configuration Management Database 7.2 IBM Change and Configuration Management Database 7.1 IBM Change and Configuration Management Database 6.2 |
| Not Vulnerable: | |
Discussion
IBM Maximo Asset Management Multiple Unspecified Cross Site Scripting Vulnerabilities
IBM Maximo Asset Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are affected:
IBM Maximo Asset Management versions 7.5, 7.1, and 6.2
IBM Maximo Asset Management Essentials versions 7.5, 7.1, and 6.2
IBM SmartCloud Control Desk 7.5
IBM Tivoli Asset Management for IT versions 7.2, 7.1, and 6.2
IBM Tivoli Change and Configuration Management Database versions 7.2 and 7.1
IBM Tivoli Service Request Manager versions 7.2, 7.1, and 6.2
IBM Maximo Asset Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are affected:
IBM Maximo Asset Management versions 7.5, 7.1, and 6.2
IBM Maximo Asset Management Essentials versions 7.5, 7.1, and 6.2
IBM SmartCloud Control Desk 7.5
IBM Tivoli Asset Management for IT versions 7.2, 7.1, and 6.2
IBM Tivoli Change and Configuration Management Database versions 7.2 and 7.1
IBM Tivoli Service Request Manager versions 7.2, 7.1, and 6.2
Solution / Fix
IBM Maximo Asset Management Multiple Unspecified Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.