CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
58.9%
There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 that are used by Maximo Asset Management, Maximo Industry Solutions (including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities) and IBM Control Desk. These issues were disclosed as part of the IBM Java SDK updates in January 2023.
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Product(s) | Version(s) |
---|---|
IBM Maximo Asset Management | 7.6.1.2 |
IBM Maximo Asset Management | 7.6.1.3 |
There are three areas where the vulnerabilities in the Java SDK/JDK or JRE may require remediation:
1. Application Server – Update the Websphere Application Server. Refer to Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to January 2023 CPU plus deferred CVE-2022-21426 for additional information on updating and maintaining the JDK component within Websphere. Customers with Oracle Weblogic Server, which is not an IBM product and is not shipped by IBM, will also want to update their server.
2. Browser Client - Update the Java plug-in used by the browser on client systems, using the remediated JRE version referenced on developerWorks JavaTM Technology Security Alerts or referenced on Oracle’s latest Critical Patch Update (which can be accessed via developerWorks JavaTM Technology Security Alerts). Updating the browser Java plug-in may impact some applets such as Maximo Asset Management Scheduler. Download from IBM FixCentral the latest Maximo Asset Management Fix Pack.
3. Admin Tools - Update the JRE version in the <MAXIMO_HOME>/tools/java directory using the remediated JRE version referenced on Java SDK downloads, version 8.0.
Due to the threat posed by a successful attack, IBM strongly recommends that customers apply fixes as soon as possible.
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | maximo_asset_management | 7.6.1 | cpe:2.3:a:ibm:maximo_asset_management:7.6.1:*:*:*:*:*:*:* |
ibm | control_desk | 7.6.1.1 | cpe:2.3:a:ibm:control_desk:7.6.1.1:*:*:*:*:*:*:* |
ibm | control_desk | 7.6.1 | cpe:2.3:a:ibm:control_desk:7.6.1:*:*:*:*:*:*:* |
ibm | maximo_for_transportation | 7.6.2.5 | cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.5:*:*:*:*:*:*:* |
ibm | maximo_for_transportation | 7.6.2.4 | cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.4:*:*:*:*:*:*:* |
ibm | maximo_for_transportation | 7.6.2.3 | cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.3:*:*:*:*:*:*:* |
ibm | maximo_for_service_providers | 7.6.3.3 | cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.3:*:*:*:*:*:*:* |
ibm | maximo_for_service_providers | 7.6.3.2 | cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.2:*:*:*:*:*:*:* |
ibm | maximo_for_service_providers | 7.6.3.1 | cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.1:*:*:*:*:*:*:* |
ibm | maximo_spatial_asset_management | 7.6.0.5 | cpe:2.3:a:ibm:maximo_spatial_asset_management:7.6.0.5:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
58.9%