CVE-2012-2184: Medium severity ibm tivoli change and configuration management database vulnerability

Published Sep 10, 2012

Updated

Session fixation vulnerability in IBM Maximo Asset Management 7.1 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote attackers to hijack web sessions via unspecified vectors.

Affected Software

12 affected components

IBM Change and Configuration Management Database=6.0

IBM Change and Configuration Management Database=7.0

IBM Maximo Asset Management=7.1.0.0

IBM Maximo Asset Management=7.5.0.0

IBM Maximo Service Desk=6.2

IBM SmartCloud Control Desk=7.0

IBM Tivoli Asset Management for IT=6.0

IBM Tivoli Asset Management for IT=6.2

IBM Tivoli Asset Management for IT=7.0

IBM Tivoli Asset Management for IT=7.1

IBM Tivoli Asset Management for IT=7.2

IBM Tivoli Service Request Manager=7.0

Event History

Sep 10, 2012

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2184?

CVE-2012-2184 is considered a medium severity vulnerability due to its potential for allowing remote session hijacking.

How do I fix CVE-2012-2184?

To mitigate CVE-2012-2184, users should upgrade to the latest patched versions of affected IBM products.

What products are affected by CVE-2012-2184?

CVE-2012-2184 affects IBM Maximo Asset Management versions 7.1 through 7.5, along with various Tivoli and SmartCloud products.

What type of attack does CVE-2012-2184 enable?

CVE-2012-2184 enables session fixation attacks, allowing attackers to hijack user sessions.

Is there a workaround for CVE-2012-2184?

Implementing secure session management practices and ensuring users log in through secure pages can serve as temporary workaround measures for CVE-2012-2184.