CVE-2020-4463: XEE
IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.
Other sources
IBM Maximo Asset Management is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-4463?
CVE-2020-4463 is considered a high severity vulnerability due to the potential for unauthorized data exposure and resource consumption.
How do I fix CVE-2020-4463?
To fix CVE-2020-4463, update IBM Maximo Asset Management to a version that is not affected by this vulnerability, specifically version 7.6.0.3 or later.
What types of attacks can exploit CVE-2020-4463?
CVE-2020-4463 can be exploited through XML External Entity Injection (XXE) attacks, allowing attackers to manipulate XML input.
What could an attacker gain from exploiting CVE-2020-4463?
An attacker exploiting CVE-2020-4463 could potentially access sensitive information stored on the server or exhaust system resources.
Which versions of IBM Maximo Asset Management are vulnerable to CVE-2020-4463?
IBM Maximo Asset Management versions 7.6.0.1 and 7.6.0.2 are vulnerable to CVE-2020-4463.