PT-2020-7437 · Ibm · Ibm Maximo Asset Management+1

Published 2020-02-18 · Updated 2020-02-21 · CVE-2013-3323

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 6.2 through 7.5

Description: A Privilege Escalation issue exists when WebSeal with Basic Authentication is used, due to a failure to invalidate the authentication session, which could let a malicious user obtain unauthorized access.

Recommendations: For versions 6.2, 7.1, and 7.5, ensure that the authentication session is properly invalidated when using WebSeal with Basic Authentication. As a temporary workaround, consider restricting access to the WebSeal authentication module until a proper fix is applied.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2013-3323

Affected Products

Ibm Maximo Asset Management

Webseal

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/77920?_ga=2.229912220.1881683942.1582039056-713214152.1572980240 · Vendor Advisory
• https://ibm.com/support/pages/node/235239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3323 · Security Note
• https://t.me/cibsecurity/9898 · Telegram Post
• http://securityfocus.com/bid/62685 · Note