Cross site scripting

2014-05-2616:55:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.8%

JSON

Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.

CPENameOperatorVersion
change_and_configuration_management_databaseeq7.1.1.7
change_and_configuration_management_databaseeq7.1
change_and_configuration_management_databaseeq7.0
change_and_configuration_management_databaseeq7.1.1.12
change_and_configuration_management_databaseeq7.1.1.11
maximo_asset_managementeq7.5.0.5
maximo_asset_managementeq7.1.1.5
maximo_asset_managementeq7.1.1.7
maximo_asset_managementeq7.1.1.10
maximo_asset_managementeq7.1.1.8

Name	Operator	Version
change_and_configuration_management_database	eq	7.1.1.7
change_and_configuration_management_database	eq	7.1
change_and_configuration_management_database	eq	7.0
change_and_configuration_management_database	eq	7.1.1.12
change_and_configuration_management_database	eq	7.1.1.11
maximo_asset_management	eq	7.5.0.5
maximo_asset_management	eq	7.1.1.5
maximo_asset_management	eq	7.1.1.7
maximo_asset_management	eq	7.1.1.10
maximo_asset_management	eq	7.1.1.8