PT-2017-12985 · Ibm · Ibm Maximo Asset Management

Published 2017-09-12 · Updated 2017-09-21 · CVE-2017-1352

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.5 through 7.6

Description The issue allows an authenticated user to inject commands into work orders. These commands could be executed by another user who downloads the affected file.

Recommendations For IBM Maximo Asset Management versions 7.5 through 7.6, consider restricting access to work order downloads to minimize the risk of exploitation until a patch is available.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-1352

Affected Products

Ibm Maximo Asset Management

References · 5

• https://osv.dev/vulnerability/CVE-2017-1352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1352 · Security Note
• http://ibm.com/support/docview.wss?uid=swg22006650 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/126538 · Note
• http://securityfocus.com/bid/100697 · Note