CVE-2011-4816 — SQL Injection in IBM Maximo Asset Management

CWE-89 — SQL Injection3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 31.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
IBM Maximo Asset ManagementIBM Maximo Asset Management EssentialsIBM Maximo Service Desk+3 more
Timeline
PublishedMar 13
Latest updateMay 14

Description

SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages6 packages

▶NVDibm/tivoli_asset_management6.2, 7.1, 7.2+2
▶NVDibm/maximo_asset_management6.2, 7.1, 7.5+2

🔴Vulnerability Details

2
GHSA
GHSA-m6ph-jw4p-wv26: SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6↗2022-05-14
▶
CVEList
CVE-2011-4816: SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6↗2012-03-13
▶
CVE-2011-4816 — SQL Injection in IBM | cvebase