low3.5

CVE-2014-0824

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivol…

Impact

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via an attachment URL.

Affected products

Vendor	Product	Affected versions
Ibm	Change And Configuration Management Database	Versions 7.0, 7.1, 7.1.1.7, 7.1.1.8, 7.1.1.12
Ibm	Maximo Service Desk	Versions 7.1.1.7, 7.1.1.8, 7.1.1.12
Ibm	Tivoli It Asset Management For It	Versions 7.1.1.7, 7.1.1.8, 7.1.1.12
Ibm	Tivoli Service Request Manager	Versions 7.0, 7.1.0, 7.1.1, 7.1.1.7, 7.1.1.8, 7.1.1.12
Ibm	Maximo Asset Management	Versions 7.1, 7.1.1, 7.1.1.1, 7.1.1.2, 7.1.1.5, 7.1.1.6

Weakness classification

CWE-79

Impact

Affected products

Weakness classification

References