Lucene search

IBM9A2091CC72699C3B7071F8AE1CCA1C0D7823AE5DD7E7BD6CE9D455DA1E0737E4

HistoryJan 05, 2023 - 6:51 p.m.

Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to CSV injection (CVE-2022-35281)

2023-01-0518:51:10

www.ibm.com

ibm maximo

csv injection

cve-2022-35281

interim fix

fix pack

fix central

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

52.7%

JSON

Summary

IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to CSV injection.

Vulnerability Details

CVEID:CVE-2022-35281
**DESCRIPTION:**IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to CSV injection.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230635 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Maximo Asset Management	7.6.1.1
IBM Maximo Asset Management	7.6.1.2
IBM Maximo Asset Management	7.6.1.3
IBM Maximo Application Suite - Manage Component	8.3
IBM Maximo Application Suite - Manage Component	8.4

Remediation/Fixes

The recommended solution is to download the appropriate Interim Fix or Fix Pack from Fix Central (What is Fix Central?) and apply for each affected product as soon as possible. Please see below for information on the fixes available for each product, version, and release. Follow the installation instructions in the ‘readme’ documentation provided with each fix pack or interim fix.

For Maximo Asset Management 7.6:

VRM	Fix Pack, Feature Pack, or Interim Fix	Download
7.6.1.1	Maximo Asset Management 7.6.1.1 iFix:
7.6.1.1-TIV-MBS-IF023 or latest Interim Fix available	FixCentral
7.6.1.2

Maximo Asset Management 7.6.1.2 iFix:

7.6.1.2-TIV-MBS-IF028 or latest Interim Fix available

FixCentral

7.6.1.3 |

Maximo Asset Management 7.6.1.3 iFix:

7.6.1.3-TIV-MBS-IF003 or latest Interim Fix available

FixCentral

For IBM Maximo Manage application in IBM Maximo Application Suite:

MAS	Manage Patch Fix or Release
8.7	8.3.4 or latest (available from the Catalog under Update Available)
8.8	8.4.1 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_asset_managementMatch7.6.1

ibmmaximo_for_service_providersMatch7.6.3.3

ibmmaximo_for_service_providersMatch7.6.3.2

ibmmaximo_for_service_providersMatch7.6.3.1

ibmmaximo_for_life_sciencesMatch7.6

ibmmaximo_for_utilitiesMatch7.6.0.2

ibmmaximo_for_utilitiesMatch7.6.0.1

ibmmaximo_for_nuclear_powerMatch7.6.1

ibmmaximo_spatial_asset_managementMatch7.6.0.5

ibmmaximo_spatial_asset_managementMatch7.6.0.4

ibmmaximo_spatial_asset_managementMatch7.6.0.3

ibmmaximo_spatial_asset_managementMatch7.6.0.2

ibmmaximo_for_oil_and_gasMatch7.6.1

ibmmaximo_for_aviationMatch7.6.6

ibmmaximo_for_aviationMatch7.6.7

ibmmaximo_for_aviationMatch7.6.8

ibmmaximo_asset_configuration_managerMatch7.6.7.1

ibmmaximo_asset_configuration_managerMatch7.6.7

ibmmaximo_asset_configuration_managerMatch7.6.6

ibmmaximo_for_transportationMatch7.6.2.5

ibmmaximo_for_transportationMatch7.6.2.4

ibmmaximo_for_transportationMatch7.6.2.3

ibmcontrol_deskMatch7.6.1.1

ibmcontrol_deskMatch7.6.1

CPENameOperatorVersion
ibm maximo asset managementeq7.6.1
ibm maximo for service providerseq7.6.3.3
ibm maximo for service providerseq7.6.3.2
ibm maximo for service providerseq7.6.3.1
maximo for life scienceseq7.6
maximo for utilitieseq7.6.0.2
maximo for utilitieseq7.6.0.1
maximo for nuclear powereq7.6.1
maximo spatial asset managementeq7.6.0.5
maximo spatial asset managementeq7.6.0.4

Name	Operator	Version
ibm maximo asset management	eq	7.6.1
ibm maximo for service providers	eq	7.6.3.3
ibm maximo for service providers	eq	7.6.3.2
ibm maximo for service providers	eq	7.6.3.1
maximo for life sciences	eq	7.6
maximo for utilities	eq	7.6.0.2
maximo for utilities	eq	7.6.0.1
maximo for nuclear power	eq	7.6.1
maximo spatial asset management	eq	7.6.0.5
maximo spatial asset management	eq	7.6.0.4

Rows per page:

1-10 of 241

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

52.7%

JSON

Related for 9A2091CC72699C3B7071F8AE1CCA1C0D7823AE5DD7E7BD6CE9D455DA1E0737E4