CVE-2016-5987: Input Validation
Published Nov 30, 2016
·Updated
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3 allows remote attackers to obtain sensitive information via a crafted HTTP request that triggers construction of a runtime error message.
Affected Software
31 affected components
IBM Maximo Asset Management=7.1.0.0
IBM Maximo Asset Management=7.1.1
IBM Maximo Asset Management=7.1.1.1
IBM Maximo Asset Management=7.1.1.2
IBM Maximo Asset Management=7.1.1.3
IBM Maximo Asset Management=7.1.1.5
IBM Maximo Asset Management=7.1.1.6
IBM Maximo Asset Management=7.1.1.7
IBM Maximo Asset Management=7.1.1.8
IBM Maximo Asset Management=7.1.1.9
IBM Maximo Asset Management=7.1.1.10
IBM Maximo Asset Management=7.1.1.11
IBM Maximo Asset Management=7.1.1.12
IBM Maximo Asset Management=7.1.1.13
IBM Maximo Asset Management=7.1.2
IBM Maximo Asset Management=7.5.0.0
IBM Maximo Asset Management=7.5.0.1
IBM Maximo Asset Management=7.5.0.2
IBM Maximo Asset Management=7.5.0.3
IBM Maximo Asset Management=7.5.0.4
IBM Maximo Asset Management=7.5.0.5
IBM Maximo Asset Management=7.5.0.6
IBM Maximo Asset Management=7.5.0.7
IBM Maximo Asset Management=7.5.0.8
IBM Maximo Asset Management=7.5.0.9
IBM Maximo Asset Management=7.5.0.10
IBM Maximo Asset Management=7.6.0.0
IBM Maximo Asset Management=7.6.0.1
IBM Maximo Asset Management=7.6.0.2
IBM Maximo Asset Management=7.6.0.3
IBM Maximo Asset Management=7.6.0.4
Remediation
Patch Available
Event History
Nov 30, 2016
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5987?
CVE-2016-5987 is classified as a medium-severity vulnerability.
2
How do I fix CVE-2016-5987?
To fix CVE-2016-5987, upgrade to IBM Maximo Asset Management versions 7.5.0.10 IF4 or 7.6.0.5 IF3 or later.
3
What type of attack is possible with CVE-2016-5987?
CVE-2016-5987 allows remote attackers to obtain sensitive information via a crafted HTTP request.
4
Which versions of IBM Maximo Asset Management are affected by CVE-2016-5987?
Affected versions include IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3.
5
What kind of information can be exposed by CVE-2016-5987?
CVE-2016-5987 can expose sensitive information in the form of runtime error messages.