CVE-2019-4644: XSS

Published Apr 17, 2020

Updated

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880.

Affected Software

42 affected components

IBM Control Desk=7.6.1

IBM Control Desk=7.6.1.1

IBM Maximo Asset Configuration Manager=7.6.6

IBM Maximo Asset Configuration Manager=7.6.7

IBM Maximo Asset Configuration Manager=7.6.7.1

IBM Maximo Asset Health Insights=7.6.1

IBM Maximo Asset Health Insights=7.6.1.1

IBM Maximo Asset Management=7.6.1.1

IBM Maximo Asset Management Scheduler=7.6.7

IBM Maximo Asset Management Scheduler=7.6.7.1

IBM Maximo Asset Management Scheduler=7.6.7.3

IBM Maximo Asset Management Scheduler Plus=7.6.7

IBM Maximo Asset Management Scheduler Plus=7.6.7.1

IBM Maximo Asset Management Scheduler Plus=7.6.7.3

IBM Maximo Calibration=7.6

IBM Maximo Enterprise Adapter=7.6

IBM Maximo Enterprise Adapter=7.6.1

IBM Maximo Equipment Maintenance Assistant

IBM Maximo For Aviation=7.6.6

IBM Maximo For Aviation=7.6.7

IBM Maximo For Aviation=7.6.8

IBM Maximo for Life Sciences=7.6

IBM Maximo for Nuclear Power=7.6.1

IBM Maximo for Oil and Gas=7.6.1

IBM Maximo For Service Providers=7.6.3.1

IBM Maximo For Service Providers=7.6.3.2

IBM Maximo For Service Providers=7.6.3.3

IBM Maximo for Transportation=7.6.2.3

IBM Maximo for Transportation=7.6.2.4

IBM Maximo for Transportation=7.6.2.5

IBM Maximo for Utilities=7.6.0.1

IBM Maximo for Utilities=7.6.0.2

IBM Maximo Linear Asset Manager=7.6.0.1

IBM Maximo Linear Asset Manager=7.6.0.2

IBM Maximo Linear Asset Manager=7.6.0.3

IBM Maximo Network On Blockchain=7.6.0.0

IBM Maximo Network On Blockchain=7.6.0.1

IBM Maximo Spatial Asset Management=7.6.0.2

IBM Maximo Spatial Asset Management=7.6.0.3

IBM Maximo Spatial Asset Management=7.6.0.4

IBM Maximo Spatial Asset Management=7.6.0.5

IBM Tivoli Integration Composer=7.6

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6191583

Event History

Apr 17, 2020

CVE Published

via MITRE·01:25 PM

Data Sourced

via MITRE·01:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-4644?

CVE-2019-4644 is a vulnerability found in IBM Maximo Asset Management 7.6 that allows for cross-site scripting (XSS) attacks.

How does CVE-2019-4644 work?

CVE-2019-4644 allows users to inject arbitrary JavaScript code on the web interface of IBM Maximo Asset Management 7.6, potentially leading to disclosure of credentials.

What is the severity of CVE-2019-4644?

CVE-2019-4644 has a severity rating of 6.1 (medium).

Which software versions are affected by CVE-2019-4644?

IBM Maximo Asset Management versions 7.6 and 7.6.1 are affected by CVE-2019-4644.

How can I fix CVE-2019-4644?

To fix CVE-2019-4644, it is recommended to apply the latest security patches provided by IBM or upgrade to a non-vulnerable version of IBM Maximo Asset Management.