PT-2025-2682 · Ibm+1 · Ibm Maximo Asset Management+1

Jihane Abou-Ayoub + 1 · Publicado 2024-11-05 · Atualizado 2025-08-14 · CVE-2024-45077

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management version 7.6.1.3

Description The issue concerns an unrestricted file upload vulnerability in the MXAPIASSET API. This vulnerability allows an authenticated low-privileged user to upload restricted file types by adding a dot to the end of the file name, but only if the system is installed on a Windows operating system.

Recommendations For IBM Maximo Asset Management version 7.6.1.3, consider restricting access to the MXAPIASSET API to prevent low-privileged users from uploading files until a patch is available. As a temporary workaround, limit the types of files that can be uploaded through this API to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-98

Identificadores relacionados

BDU:2025-11365

CVE-2024-45077

Produtos afetados

Ibm Maximo Asset Management

Windows

Referências · 9

• https://ibm.com/support/pages/node/7174819 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-45077 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1882876301511459093 · Publicação no Twitter
• https://t.me/cvedetector/16302 · Publicação no Telegram
• https://vuldb.com/pl/?id.293285 · Nota
• https://bdu.fstec.ru/vul/2025-11365 · Nota de Segurança
• https://t.me/cveNotify/132264 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-45077 · Nota de Segurança
• https://twitter.com/CVEnew/status/1882818218017857600 · Publicação no Twitter