PT-2025-2435 · Ibm · Ibm Maximo Application Suite

Published 2025-01-25 · Updated 2025-07-08 · CVE-2024-35150

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite versions 8.10.12 through 9.1.0

Description: The issue is related to the Monitor Component of the IBM Maximo Application Suite, which fails to properly handle log output. This could allow a remote attacker to inject false log entries, potentially leading to security issues. The problem is associated with the component's inability to neutralize output written to logs.

Recommendations: For versions 8.10.12, 8.11.0, 9.0.1, and 9.1.0, consider restricting access to the Monitor Component until a patch is available to prevent potential log manipulation. As a temporary workaround, consider disabling the logging functionality of the Monitor Component to minimize the risk of exploitation. Avoid using the affected versions of the IBM Maximo Application Suite until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-117

Related Identifiers

BDU:2025-01189

CVE-2024-35150

Affected Products

Ibm Maximo Application Suite

References · 9

• https://ibm.com/support/pages/node/7180057 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35150 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01189 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35150 · Security Note
• https://t.me/cvedetector/16401 · Telegram Post
• https://t.me/cvenotify/128069 · Telegram Post
• https://t.me/cvenotify/108622 · Telegram Post
• https://twitter.com/CVEnew/status/1883165471270211717 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1883193900312952875 · Twitter Post