CVE-2023-32334

IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 255074.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/255074	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6999721	Vendor Advisory
https://www.ibm.com/support/pages/node/6999747	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:maximo_application_suite:8.8.0:::::::*
	cpe:2.3:a:ibm:maximo_asset_management:7.6.1.2:::::::*
	cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:::::::*

History

10 Jun 2023, 00:01

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ibm:maximo_asset_management:7.6.1.2:::::::* cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:::::::* cpe:2.3:a:ibm:maximo_application_suite:8.8.0:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CWE		NVD-CWE-noinfo
References	~~(MISC) https://exchange.xforce.ibmcloud.com/vulnerabilities/255074 -~~	(MISC) https://exchange.xforce.ibmcloud.com/vulnerabilities/255074 - VDB Entry, Vendor Advisory
References	~~(MISC) https://www.ibm.com/support/pages/node/6999721 -~~	(MISC) https://www.ibm.com/support/pages/node/6999721 - Vendor Advisory
References	~~(MISC) https://www.ibm.com/support/pages/node/6999747 -~~	(MISC) https://www.ibm.com/support/pages/node/6999747 - Patch, Vendor Advisory
First Time		Ibm maximo Asset Management Ibm Ibm maximo Application Suite

05 Jun 2023, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-05 01:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-32334

Mitre link : CVE-2023-32334

CVE.ORG link : CVE-2023-32334

JSON object : View

Products Affected

ibm

maximo_asset_management
maximo_application_suite

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-32334", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2023-06-05T01:15:45.960", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255074", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6999721", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6999747", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 255074."}, {"lang": "es", "value": "IBM Maximo Asset Management v7.6.1.2, v7.6.1.3 e IBM Maximo Application Suite v8.8.0 almacenan informaci\u00f3n confidencial en par\u00e1metros de URL. Esto puede dar lugar a la divulgaci\u00f3n de informaci\u00f3n si partes no autorizadas tienen acceso a las URL a trav\u00e9s de los registros del servidor, el encabezado de referencia o el historial del navegador. IBM X-Force ID: 255074. "}], "lastModified": "2023-06-10T00:01:21.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:8.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1328EB4A-2930-4617-9B01-B704A241FDEB"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F9DA22B-5DD7-4551-AC7A-61949D246F5D"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0279056-1BD2-4CD6-86BA-DDAA6AB53C6F"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}