9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
38.0%
IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controls (CVE-2023-32333). This only impacts environments using native Maximo security when security options have been incorrectly applied to the MAXREG user.
CVEID:CVE-2023-32333
**DESCRIPTION:**IBM Maximo Asset Management could allow a remote attacker to log into the admin panel due to improper access controls.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/255073 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Product versions affected:
Affected Product(s) | Version(s) |
---|---|
IBM Maximo Asset Management | 7.6.1.3 |
The recommended solution is to download the appropriate Interim Fix or Fix Pack from Fix Central and apply for each affected product as soon as possible. Please see below for information on the fixes available for each product, version, and release. Follow the installation instructions in the βreadmeβ documentation provided with each fix pack or interim fix.
For Maximo Asset Management 7.6:
VRM | Fix Pack, Feature Pack, or Interim Fix | Download |
---|---|---|
7.6.1.3 |
Maximo Asset Management 7.6.1.3 iFix:
7.6.1.3-TIV-MBS-IF012 or latest Interim Fix available
|
Additional manual steps are required to ensure the issue is resolved. See the**Workarounds and Mitigations **section.
Note: In the instructions below, the names for the Self-Registration and Everyone groups vary by installation. If you are unsure of the actual group name, look it up as follows:
Ensure that the following security privileges are correctly configured:
1. The MAXREG user must only belong to the User Registration group. To confirm:
Note: The Everyone group cannot be removed from the UI and must be deleted directly in the database if needed. This is only required if this group has been granted specific application access (which is not recommended).
2. The User Registration group must only have access to the applications SELFREG and FORGOTPSWD. To confirm:
This can also be achieved by executing the following query to check for any incorrect permissions:
select * from applicationauth where groupname = <user registration group> and app not in (βSELFREGβ,βFORGOTPSWDβ)
If any are present, they can be revoked as follows:
delete from applicationauth where groupname = <user registration group> and app not in (βSELFREGβ,βFORGOTPSWDβ)
CPE | Name | Operator | Version |
---|---|---|---|
ibm maximo asset management | eq | 7.6.1 |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
38.0%