Lucene search

[email protected]CVE-2015-5016

HistoryMar 27, 2018 - 5:29 p.m.

CVE-2015-5016

2018-03-2717:29:00

CWE-200

[email protected]

web.nvd.nist.gov

ibm

maximo asset management

vulnerability

authenticated

access restrictions

ticket worklog

cve-2015-5016

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.5%

JSON

IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Management for IT 7.1 and 7.2; and certain other IBM products allow remote authenticated users to bypass intended access restrictions and read arbitrary ticket worklog entries via unspecified vectors. IBM X-Force ID: 106460.

Affected configurations

NVD

Node

ibmmaximo_asset_managementMatch7.1

ibmmaximo_asset_managementMatch7.5

ibmmaximo_asset_managementMatch7.6

Node

ibmmaximo_asset_management_essentialsMatch7.1

ibmmaximo_asset_management_essentialsMatch7.5

Node

ibmmaximo_for_energy_optimizationMatch7.1

Node

ibmmaximo_for_aviationMatch7.6

Node

ibmmaximo_for_governmentMatch7.1

ibmmaximo_for_governmentMatch7.5

Node

ibmmaximo_for_nuclear_powerMatch7.1

ibmmaximo_for_nuclear_powerMatch7.5

Node

ibmmaximo_for_transportationMatch7.1

ibmmaximo_for_transportationMatch7.5

ibmmaximo_for_transportationMatch7.6

Node

ibmmaximo_for_life_sciencesMatch7.1

ibmmaximo_for_life_sciencesMatch7.5

ibmmaximo_for_life_sciencesMatch7.6

Node

ibmmaximo_for_oil_and_gasMatch7.1

ibmmaximo_for_oil_and_gasMatch7.5

Node

ibmmaximo_for_utilitiesMatch7.1

ibmmaximo_for_utilitiesMatch7.5

Node

ibmcontrol_deskMatch7.5

ibmcontrol_deskMatch7.6

Node

ibmtivoli_asset_management_for_itMatch7.1

ibmtivoli_asset_management_for_itMatch7.2

Node

ibmtivoli_service_request_managerMatch7.1

ibmtivoli_service_request_managerMatch7.2

Node

ibmchange_and_configuration_management_databaseMatch7.1

ibmchange_and_configuration_management_databaseMatch7.2

CPENameOperatorVersion
ibm:maximo_asset_managementibm maximo asset managementeq7.1
ibm:maximo_asset_managementibm maximo asset managementeq7.5
ibm:maximo_asset_managementibm maximo asset managementeq7.6

CPE	Name	Operator	Version
ibm:maximo_asset_management	ibm maximo asset management	eq	7.1
ibm:maximo_asset_management	ibm maximo asset management	eq	7.5
ibm:maximo_asset_management	ibm maximo asset management	eq	7.6

References

www-01.ibm.com/support/docview.wss?uid=swg21971160

exchange.xforce.ibmcloud.com/vulnerabilities/106460

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.5%

JSON

Related for CVE-2015-5016

prion1 cvelist1 nvd1 ibm1