PT-2025-2682 · Ibm+1 · Ibm Maximo Asset Management+1

Jihane Abou-Ayoub + 1 · Published 2024-11-05 · Updated 2025-08-14 · CVE-2024-45077

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management version 7.6.1.3

Description The issue concerns an unrestricted file upload vulnerability in the MXAPIASSET API. This vulnerability allows an authenticated low-privileged user to upload restricted file types by adding a dot to the end of the file name, but only if the system is installed on a Windows operating system.

Recommendations For IBM Maximo Asset Management version 7.6.1.3, consider restricting access to the MXAPIASSET API to prevent low-privileged users from uploading files until a patch is available. As a temporary workaround, limit the types of files that can be uploaded through this API to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

BDU:2025-11365

CVE-2024-45077

Affected Products

Ibm Maximo Asset Management

Windows

References · 9

• https://ibm.com/support/pages/node/7174819 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45077 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11365 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45077 · Security Note
• https://twitter.com/VulmonFeeds/status/1882876301511459093 · Twitter Post
• https://t.me/cvedetector/16302 · Telegram Post
• https://vuldb.com/pl/?id.293285 · Note
• https://t.me/cveNotify/132264 · Telegram Post
• https://twitter.com/CVEnew/status/1882818218017857600 · Twitter Post