NetSight
IP …
medium6.5

CVE-2013-5465

IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.…

Impact

IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.3 IFIX027, and 7.5.0.4 before IFIX011; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140207-1801, and 7.1.1.12 before IFIX.20140218-1510 do not properly restrict file types during uploads, which allows remote authenticated users to have an unspecified impact via an invalid type.

Affected products

VendorProductAffected versions
IbmMaximo Asset Management
Versions 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.1
IbmChange And Configuration Management Database
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmMaximo Service Desk
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmTivoli Asset Management For It
Versions 7.0, 7.1
IbmTivoli It Asset Management For It
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmTivoli Service Request Manager
Versions 7.1.1, 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmSmartcloud Control Desk
Versions 7.0, 7.5, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.1.0

Weakness classification

CWE-264

References