NetSight
IP …
low3.5

CVE-2014-0825

Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX0…

Impact

Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.

Affected products

VendorProductAffected versions
IbmChange And Configuration Management Database
Versions 7.0, 7.1, 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmMaximo Service Desk
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmTivoli It Asset Management For It
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmTivoli Service Request Manager
Versions 7.0, 7.1.0, 7.1.0.0, 7.1.1, 7.1.1.7, 7.1.1.11
IbmSmartcloud Control Desk
Versions 7.0, 7.5, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.1.0
IbmMaximo Asset Management
Versions 7.1, 7.1.1, 7.1.1.1, 7.1.1.2, 7.1.1.5, 7.1.1.6

Weakness classification

CWE-79

References