Lucene search

IBM61E19504A0495042AC28C9578DBDBA8AF4616E908BCD2058E91C4B4D8E22DD5B

HistoryJul 05, 2022 - 7:18 p.m.

Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-22436)

2022-07-0519:18:34

www.ibm.com

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.6%

JSON

Summary

IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting.

Vulnerability Details

CVEID:CVE-2022-22436
**DESCRIPTION:**IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224164 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
Manage Component	All
IBM Maximo Asset Management	7.6.1.2
IBM Maximo Asset Management	7.6.1.1

Remediation/Fixes

The recommended solution is to download the appropriate Interim Fix or Fix Pack from Fix Central (What is Fix Central?) and apply for each affected product as soon as possible. Please see below for information on the fixes available for each product, version, and release. Follow the installation instructions in the ‘readme’ documentation provided with each fix pack or interim fix.

For Maximo Asset Management 7.6:

VRM	Fix Pack, Feature Pack, or Interim Fix	Download
7.6.1.2	Maximo Asset Management 7.6.1.2 iFix:
7.6.1.2-TIV-MBS-IF018 or latest Interim Fix available	FixCentral
7.6.1.1	Maximo Asset Management 7.6.1.1 iFix:
7.6.1.1-TIV-MBS-IF021 or latest Interim Fix available	FixCentral

For IBM Maximo Manage application in IBM Maximo Application Suite:

First upgrade to Maximo Application Suite version 8.7.2 and then from the Catalog select Update Available for Manage 8.3.1.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_asset_managementMatch7.6.1

ibmmaximo_for_oil_and_gasMatch7.6.1

ibmmaximo_for_transportationMatch7.6.2.5

ibmmaximo_for_transportationMatch7.6.2.4

ibmmaximo_for_transportationMatch7.6.2.3

ibmmaximo_for_aviationMatch7.6.8

ibmmaximo_for_aviationMatch7.6.7

ibmmaximo_for_aviationMatch7.6.6

ibmmaximo_for_life_sciencesMatch7.6

ibmmaximo_for_utilitiesMatch7.6.0.2

ibmmaximo_for_utilitiesMatch7.6.0.1

ibmmaximo_spatial_asset_managementMatch7.6.0.5

ibmmaximo_spatial_asset_managementMatch7.6.0.4

ibmmaximo_spatial_asset_managementMatch7.6.0.3

ibmmaximo_spatial_asset_managementMatch7.6.0.2

ibmmaximo_for_nuclear_powerMatch7.6.1

ibmcontrol_deskMatch7.6.1.1

ibmcontrol_deskMatch7.6.1

ibmmaximo_for_service_providersMatch7.6.3.3

ibmmaximo_for_service_providersMatch7.6.3.2

ibmmaximo_for_service_providersMatch7.6.3.1

ibmmaximo_asset_configuration_managerMatch7.6.7.1

ibmmaximo_asset_configuration_managerMatch7.6.7

ibmmaximo_asset_configuration_managerMatch7.6.6

CPENameOperatorVersion
ibm maximo asset managementeq7.6.1
maximo for oil and gaseq7.6.1
maximo for transportationeq7.6.2.5
maximo for transportationeq7.6.2.4
maximo for transportationeq7.6.2.3
ibm maximo for aviationeq7.6.8
ibm maximo for aviationeq7.6.7
ibm maximo for aviationeq7.6.6
maximo for life scienceseq7.6
maximo for utilitieseq7.6.0.2

Name	Operator	Version
ibm maximo asset management	eq	7.6.1
maximo for oil and gas	eq	7.6.1
maximo for transportation	eq	7.6.2.5
maximo for transportation	eq	7.6.2.4
maximo for transportation	eq	7.6.2.3
ibm maximo for aviation	eq	7.6.8
ibm maximo for aviation	eq	7.6.7
ibm maximo for aviation	eq	7.6.6
maximo for life sciences	eq	7.6
maximo for utilities	eq	7.6.0.2

Rows per page:

1-10 of 241

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.6%

JSON

Related for 61E19504A0495042AC28C9578DBDBA8AF4616E908BCD2058E91C4B4D8E22DD5B