IBM Maximo Asset Management CVE-2014-0914 Cross Site Scripting Vulnerability
BID:68839
Info
IBM Maximo Asset Management CVE-2014-0914 Cross Site Scripting Vulnerability
| Bugtraq ID: | 68839 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-0914 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 23 2014 12:00AM |
| Updated: | Jul 23 2014 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Tivoli Service Request Manager 7.2 IBM Tivoli Service Request Manager 7.1 IBM Tivoli Asset Management for IT 7.5 IBM Maximo Service Desk 6.2 IBM Maximo Asset Management Essentials 7.5 IBM Maximo Asset Management Essentials 7.1 IBM Maximo Asset Management Essentials 6.2 IBM Maximo Asset Management 7.5 IBM Maximo Asset Management 7.1 IBM Maximo Asset Management 6.2 IBM Change and Configuration Management Database 7.2 IBM Change and Configuration Management Database 7.1 |
| Not Vulnerable: | |
Discussion
IBM Maximo Asset Management CVE-2014-0914 Cross Site Scripting Vulnerability
IBM Maximo Asset Management is prone to cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
The following products are vulnerable:
IBM Maximo Asset Management 7.5, 7.1 and 6.2
IBM Maximo Asset Management Essentials 7.5, 7.1 and 6.2
IBM Maximo for Government 7.5, 7.1 and 6.2
IBM Maximo for Nuclear Power 7.5, 7.1, 6.2 and 6.3
IBM Maximo for Transportation 7.5, 7.1, 6.2 and 6.3
IBM Maximo for Life Sciences 7.5, 7.1, 6.2, 6.4 and 6.5
IBM Maximo for Oil and Gas 7.5, 7.1, 6.2, 6.3 and 6.4
IBM Maximo for Utilities 7.5, 7.1, 6.2 and 6.3
IBM SmartCloud Control Desk 7.5
IBM Tivoli Asset Management for IT 7.2, 7.1 and 6.2
IBM Tivoli Service Request Manager 7.2, 7.1 and Maximo Service Desk 6.2
IBM Change and Configuration Management Database 7.2 and 7.1
IBM Maximo Asset Management is prone to cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
The following products are vulnerable:
IBM Maximo Asset Management 7.5, 7.1 and 6.2
IBM Maximo Asset Management Essentials 7.5, 7.1 and 6.2
IBM Maximo for Government 7.5, 7.1 and 6.2
IBM Maximo for Nuclear Power 7.5, 7.1, 6.2 and 6.3
IBM Maximo for Transportation 7.5, 7.1, 6.2 and 6.3
IBM Maximo for Life Sciences 7.5, 7.1, 6.2, 6.4 and 6.5
IBM Maximo for Oil and Gas 7.5, 7.1, 6.2, 6.3 and 6.4
IBM Maximo for Utilities 7.5, 7.1, 6.2 and 6.3
IBM SmartCloud Control Desk 7.5
IBM Tivoli Asset Management for IT 7.2, 7.1 and 6.2
IBM Tivoli Service Request Manager 7.2, 7.1 and Maximo Service Desk 6.2
IBM Change and Configuration Management Database 7.2 and 7.1
Exploit / POC
IBM Maximo Asset Management CVE-2014-0914 Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.
Solution / Fix
IBM Maximo Asset Management CVE-2014-0914 Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Maximo Asset Management CVE-2014-0914 Cross Site Scripting Vulnerability
References:
References:
- IBM Homepage (IBM)