NetSight
IP …
low3.5

CVE-2013-5402

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, M…

Impact

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities 7.1.x through 7.1.1.12, 7.1.2, 7.5 before 7.5.0.3 IFIX014, and 7.5.0.5 before IFIX003; SmartCloud Control Desk (SCCD) 7.5 before 7.5.0.3 IFIX014 and 7.5.0.5 before IFIX003; and Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.1.x through 7.1.1.12, 7.1.2, and 7.2.x through 7.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Affected products

VendorProductAffected versions
IbmMaximo Asset Management
Versions 7.1, 7.1.1, 7.1.1.1, 7.1.1.2, 7.1.1.5, 7.1.1.6
IbmMaximo Asset Management Essentials
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmMaximo For Government
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmMaximo For Life Sciences
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmMaximo For Nuclear Power
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmMaximo For Oil And Gas
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmMaximo For Transportation
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmMaximo For Utilities
Versions 7.1, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4
IbmSmartcloud Control Desk
Versions 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.5
IbmChange And Configuration Management Database
Versions 7.1.1.12, 7.1.2, 7.2, 7.2.0.1
IbmTivoli Asset Management For It
Versions 7.1.1.12, 7.1.2, 7.2, 7.2.0.1
IbmTivoli Service Request Manager
Versions 7.1.1.12, 7.1.2, 7.2, 7.2.0.1, 7.2.1.0

Weakness classification

CWE-79

References