CVE-2016-6072: XSS

Published Feb 1, 2017

Updated

IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

12 affected components

IBM Maximo Asset Management=7.6.0.0

IBM Maximo For Aviation

IBM Maximo for Life Sciences

IBM Maximo for Nuclear Power

IBM Maximo for Oil and Gas

IBM Maximo for Transportation

IBM Maximo for Utilities

IBM SmartCloud Control Desk

IBM Tivoli Asset Management for IT

IBM Tivoli Change and Configuration Management Database

IBM Tivoli Integration Composer

IBM Tivoli Service Request Manager

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21991893

Event History

Feb 1, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-6072?

The severity of CVE-2016-6072 is considered high due to its potential for credential disclosure through cross-site scripting.

How do I fix CVE-2016-6072?

To fix CVE-2016-6072, apply the latest patches and updates provided by IBM for the affected Maximo Asset Management versions.

Which versions of IBM Maximo Asset Management are affected by CVE-2016-6072?

CVE-2016-6072 affects IBM Maximo Asset Management version 7.6.0.0 and potentially other related products that share the vulnerability.

What kind of attack can be performed using CVE-2016-6072?

CVE-2016-6072 allows attackers to inject arbitrary JavaScript code into the web UI, potentially leading to unauthorized actions within a user's session.

Is user interaction required for exploiting CVE-2016-6072?

Yes, user interaction is required to activate the cross-site scripting vulnerability in CVE-2016-6072.