CVE-2019-4749: XSS

Q: What is the vulnerability ID for IBM Maximo Asset Management?

The vulnerability ID for IBM Maximo Asset Management is CVE-2019-4749.

Q: What is the severity of CVE-2019-4749?

The severity of CVE-2019-4749 is medium.

Q: How does CVE-2019-4749 impact IBM Maximo Asset Management?

CVE-2019-4749 allows users to embed arbitrary JavaScript code in the Web UI of IBM Maximo Asset Management, potentially leading to credentials disclosure within a trusted session.

Q: Which versions of IBM Maximo Asset Management are affected by CVE-2019-4749?

Versions up to and including 7.6.1.1 of IBM Maximo Asset Management are affected by CVE-2019-4749.

Q: How can I fix the cross-site scripting vulnerability in IBM Maximo Asset Management?

To fix the cross-site scripting vulnerability in IBM Maximo Asset Management, update to a version that is not affected by CVE-2019-4749.

Published Apr 16, 2020

Updated

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308.

Other sources

IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

44 affected components

IBM Maximo Asset Management<=7.6.1.1

IBM Control Desk=7.6.1

IBM Control Desk=7.6.1.1

IBM Maximo Asset Configuration Manager=7.6.6

IBM Maximo Asset Configuration Manager=7.6.7

IBM Maximo Asset Configuration Manager=7.6.7.1

IBM Maximo Asset Health Insights=7.6.1

IBM Maximo Asset Health Insights=7.6.1.1

IBM Maximo Asset Management=7.6.1.1

IBM Maximo Asset Management Scheduler=7.6.7

IBM Maximo Asset Management Scheduler=7.6.7.1

IBM Maximo Asset Management Scheduler=7.6.7.3

IBM Maximo Asset Management Scheduler Plus=7.6.7

IBM Maximo Asset Management Scheduler Plus=7.6.7.1

IBM Maximo Asset Management Scheduler Plus=7.6.7.3

IBM Maximo Calibration=7.6

IBM Maximo Enterprise Adapter=7.6

IBM Maximo Enterprise Adapter=7.6.1

IBM Maximo Equipment Maintenance Assistant

IBM Maximo For Aviation=7.6.6

IBM Maximo For Aviation=7.6.7

IBM Maximo For Aviation=7.6.8

IBM Maximo for Life Sciences=7.6

IBM Maximo for Nuclear Power=7.6.1

IBM Maximo for Oil and Gas=7.6.1

IBM Maximo For Service Providers=7.6.3.1

IBM Maximo For Service Providers=7.6.3.2

IBM Maximo For Service Providers=7.6.3.3

IBM Maximo for Transportation=7.6.2.3

IBM Maximo for Transportation=7.6.2.4

IBM Maximo for Transportation=7.6.2.5

IBM Maximo for Utilities=7.6.0.1

IBM Maximo for Utilities=7.6.0.2

IBM Maximo Linear Asset Manager=7.6.0.1

IBM Maximo Linear Asset Manager=7.6.0.2

IBM Maximo Linear Asset Manager=7.6.0.3

IBM Maximo Network On Blockchain=7.6.0.0

IBM Maximo Network On Blockchain=7.6.0.1

IBM Maximo Spatial Asset Management=7.6.0.2

IBM Maximo Spatial Asset Management=7.6.0.3

IBM Maximo Spatial Asset Management=7.6.0.4

IBM Maximo Spatial Asset Management=7.6.0.5

IBM Tivoli Integration Composer=7.6.0.1

IBM Tivoli Integration Composer=7.6.0.2

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6193479

Event History

Apr 16, 2020

CVE Published

via IBM·12:00 AM

Apr 17, 2020

CVE Published

via MITRE·01:25 PM

Data Sourced

via MITRE·01:25 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6193479

Frequently Asked Questions

What is the vulnerability ID for IBM Maximo Asset Management?