PT-2020-4090 · Ibm · Ibm Maximo Asset Management

Andrey Medov + 1 · Published 2020-06-08 · Updated 2020-06-09 · CVE-2020-4529

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1

Description: The issue is related to insufficient validation of incoming requests, which may allow a remote attacker to perform a Server Side Request Forgery (SSRF) attack. This could enable an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Recommendations: For versions 7.6.0 and 7.6.1, consider restricting access to vulnerable components or functions until a patch is available. As a temporary workaround, disabling the functionality that allows server-side requests may help minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2020-04490

CVE-2020-4529

Affected Products

Ibm Maximo Asset Management

References · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/182713 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4529 · Security Note
• https://bdu.fstec.ru/vul/2020-04490 · Security Note
• https://ibm.com/support/pages/node/6220528 · Vendor Advisory
• https://t.me/cvenotify/4239 · Telegram Post