PT-2014-5075 · Ibm · Ibm Maximo Asset Management

Published 2014-08-29 · Updated 2017-08-29 · CVE-2014-3084

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.1 through 6.5 IBM Maximo Asset Management versions 7.1 through 7.1.1.13 IBM Maximo Asset Management versions 7.5 through 7.5.0.6 IBM Maximo Asset Management versions 7.5.0 through 7.5.0.3 for SmartCloud Control Desk IBM Maximo Asset Management versions 7.5.1 through 7.5.1.2 for SmartCloud Control Desk IBM Maximo Asset Management version 6.2.8 for Tivoli IT Asset Management for IT IBM Maximo Asset Management version 7.1 for Tivoli IT Asset Management for IT IBM Maximo Asset Management version 7.2 for Tivoli IT Asset Management for IT

Description The issue allows remote authenticated users to bypass intended write-access restrictions on calendar entries.

Recommendations For IBM Maximo Asset Management versions 6.1 through 6.5, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management versions 7.1 through 7.1.1.13, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management versions 7.5 through 7.5.0.6, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management versions 7.5.0 through 7.5.0.3 for SmartCloud Control Desk, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management versions 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management version 6.2.8 for Tivoli IT Asset Management for IT, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management version 7.1 for Tivoli IT Asset Management for IT, update to a version outside of this range to resolve the issue. For IBM Maximo Asset Management version 7.2 for Tivoli IT Asset Management for IT, update to a version outside of this range to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3084

Affected Products

Ibm Maximo Asset Management

References · 7

• http://www-01.ibm.com/support/docview.wss?uid=swg1IV61274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3084 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21681020 · Vendor Advisory
• http://secunia.com/advisories/60453 · Note
• http://securitytracker.com/id/1030780 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93955 · Note
• http://secunia.com/advisories/60408 · Note