CVE-2016-5902: XSS

Published Feb 8, 2017

Updated

IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

27 affected components

IBM Maximo Asset Management=7.1

IBM Maximo Asset Management=7.5

IBM Maximo Asset Management=7.6

IBM Maximo For Aviation=7.1

IBM Maximo For Aviation=7.5

IBM Maximo For Aviation=7.6

IBM Maximo For Energy Optimization=7.1

IBM Maximo For Energy Optimization=7.5

IBM Maximo For Energy Optimization=7.6

IBM Maximo for Government=7.1

IBM Maximo for Government=7.5

IBM Maximo for Government=7.6

IBM Maximo for Life Sciences=7.1

IBM Maximo for Life Sciences=7.5

IBM Maximo for Life Sciences=7.6

IBM Maximo for Nuclear Power=7.1

IBM Maximo for Nuclear Power=7.5

IBM Maximo for Nuclear Power=7.6

IBM Maximo for Oil and Gas=7.1

IBM Maximo for Oil and Gas=7.5

IBM Maximo for Oil and Gas=7.6

IBM Maximo for Transportation=7.1

IBM Maximo for Transportation=7.5

IBM Maximo for Transportation=7.6

IBM Maximo for Utilities=7.1

IBM Maximo for Utilities=7.5

IBM Maximo for Utilities=7.6

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21988252

Event History

Feb 8, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-5902?

CVE-2016-5902 has a critical severity rating due to its potential for cross-site scripting attacks which can lead to credential disclosure.

How do I fix CVE-2016-5902?

To fix CVE-2016-5902, apply the latest patches provided by IBM for the affected versions of Maximo Asset Management.

Which versions are affected by CVE-2016-5902?

CVE-2016-5902 affects IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 and various Maximo products including aviation and utilities.

What type of attack is associated with CVE-2016-5902?

CVE-2016-5902 enables cross-site scripting (XSS) attacks, allowing attackers to inject malicious JavaScript into web pages.

Can CVE-2016-5902 lead to data theft?

Yes, due to the nature of cross-site scripting, CVE-2016-5902 can potentially lead to credential disclosure and data theft within trusted sessions.