Information disclosure in IBM Maximo Asset Management - CVE-2023-32334

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU76735

Information disclosure in IBM Maximo Asset Management - CVE-2023-32334

Published: June 1, 2023


Vulnerability identifier: #VU76735
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-32334
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to IBM Maximo Asset Management stores sensitive information in URL parameters. A remote attacker with access to the URLs via server logs, referrer header or browser history can gain unauthorized access to sensitive information on the system.


Affected software

IBM Maximo Asset Management
Maximo Manage Application in IBM Maximo Application Suite

How to mitigate CVE-2023-32334

Install updates from vendor's website.

IBM Maximo Asset Management - addressed in versions 7.6.1.2.0.24, 7.6.1.3.0.1
Maximo Manage Application in IBM Maximo Application Suite - update to 8.4.4

External References

Related Security Bulletins