CSRF in IBM Maximo Asset Management
CVE-2014-3024
Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 through 7.5.0.6 and Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk allows remote authenticated users to hijack the authentication of arbitrary users.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.008 (52.7th percentile) — read the EPSS interpretation.
Affected products
- Ibm Maximo_asset_management — versions 7.1, 7.1.1, 7.1.1.1
- Ibm Smartcloud_control_desk — versions 7.5.0.0, 7.5.0.1, 7.5.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (vdb-entry, x_refsource_SECTRACK)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)
- psirt@us.ibm.com (x_refsource_SECUNIA, third-party-advisory)