Lucene search

IBMDAEA45AB8F0184DA7A8214DFE11D42909E56B22C88CCEB9E5A4187D338C87D6C

HistoryMar 29, 2023 - 5:14 p.m.

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to stored cross-site scripting (CVE-2022-35645)

2023-03-2917:14:07

www.ibm.com

ibm maximo

stored cross-site scripting

version 8.4

version 8.5

patch

vulnerability

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.9%

JSON

Summary

IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to stored cross-site scripting.

Vulnerability Details

CVEID:CVE-2022-35645
**DESCRIPTION:**IBM Maximo Asset Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 6.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230958 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

Affected Products and Versions

Product versions affected:

Affected Product(s)	Version(s)
Maximo Manage Application in IBM Maximo Application Suite	MAS 8.8-Manage 8.4
Maximo Manage Application in IBM Maximo Application Suite	MAS 8.9-Manage 8.5

Remediation/Fixes

For IBM Maximo Manage application in IBM Maximo Application Suite:

MAS	Manage Patch Fix or Release
8.8	8.4.4 or latest (available from the Catalog under Update Available)
8.9	8.5.2 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_application_suiteMatch8.8

ibmmaximo_application_suiteMatch8.9

CPENameOperatorVersion
ibm maximo application suiteeq8.8
ibm maximo application suiteeq8.9

CPE	Name	Operator	Version
	ibm maximo application suite	eq	8.8
	ibm maximo application suite	eq	8.9

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.9%

JSON

Related for DAEA45AB8F0184DA7A8214DFE11D42909E56B22C88CCEB9E5A4187D338C87D6C