Robert Petrunic

Name of the Vulnerable Software and Affected Versions: IBM Maximo MXAPIASSET API version 7.6.1.3 Description: The issue allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Recommendations: For IBM Maximo MXAPIASSET API version 7.6.1.3, consider restricting access to sensitive files and directories to minimize the risk of exploitation. As a temporary workaround, consider implementing additional validation on URL requests to prevent directory traversal attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM Maximo Asset Management version 7.6.1.3 **Description** The issue concerns an unrestricted file upload vulnerability in the MXAPIASSET API. This vulnerability allows an authenticated low-privileged user to upload restricted file types by adding a dot to the end of the file name, but only if the system is installed on a Windows operating system. **Recommendations** For IBM Maximo Asset Management version 7.6.1.3, consider restricting access to the MXAPIASSET API to prevent low-privileged users from uploading files until a patch is available. As a temporary workaround, limit the types of files that can be uploaded through this API to minimize the risk of exploitation.