CVE-2011-1397: CSRF
Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to hijack the authentication of arbitrary users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1397?
CVE-2011-1397 is classified as a medium severity cross-site request forgery (CSRF) vulnerability.
How do I fix CVE-2011-1397?
To mitigate CVE-2011-1397, implement CSRF tokens in forms and validate incoming requests for authenticity.
Which IBM software is affected by CVE-2011-1397?
CVE-2011-1397 affects multiple IBM products including Maximo Asset Management, Tivoli Asset Management, and Maximo Service Desk across various versions.
What are the potential impacts of CVE-2011-1397?
If exploited, CVE-2011-1397 could allow an attacker to perform unauthorized actions on behalf of authenticated users.
Is there a patch available for CVE-2011-1397?
IBM has provided updates and patches for affected software versions to address CVE-2011-1397; check the official IBM support channels for specific remedies.