CVE-2015-7448

EUVD-2015-7372 · Published Mar 12, 2016

SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX003, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Technologies

Ibm Smartcloud Control DeskIbm Maximo For Life SciencesIbm Change And Configuration Management DatabaseIbm Maximo For GovernmentIbm Maximo For Energy OptimizationIbm Maximo For Oil And GasIbm Maximo Asset Management EssentialsIbm Maximo For UtilitiesIbm Maximo For TransportationIbm Tivoli Asset Management For ItIbm Maximo For Nuclear PowerIbm Tivoli Service Request ManagerIbm Maximo Asset Management

Weaknesses

CWE-89

CVSS scores

v3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
v2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

http://www-01.ibm.com/support/docview.wss?uid=swg21974938

Potentially impacted assets

See if this affects your attack surface