CVE-2011-1397 — Cross-Site Request Forgery in IBM Maximo Asset Management

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
6.8MEDIUMNVD
EPSS
0.2%
top 53.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
IBM Maximo Asset ManagementIBM Maximo Asset Management EssentialsIBM Maximo Service Desk+3 more
Timeline
PublishedMar 13
Latest updateMay 14

Description

Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to hijack the authentication of arbitrary users.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages6 packages

▶NVDibm/tivoli_asset_management6.2, 7.1, 7.2+2
▶NVDibm/maximo_asset_management6.2, 7.1, 7.5+2

🔴Vulnerability Details

2
GHSA
GHSA-p8c8-m27g-cvh6: Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6↗2022-05-14
▶
CVEList
CVE-2011-1397: Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6↗2012-03-13
▶
CVE-2011-1397 — Cross-Site Request Forgery in IBM | cvebase