CVE-2012-0195

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.5%

top 35.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Maximo Asset Management IBM Maximo Asset Management Essentials IBM Maximo Service Desk +3 more

Timeline

PublishedMar 13

Latest updateMay 4

Description

Cross-site scripting (XSS) vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to inject arbitrary web script or HTML via the display name.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages6 packages

▶NVDibm/tivoli_change_and_configuration_management_database6.2, 7.1, 7.2+2

▶NVDibm/tivoli_asset_management6.2, 7.1, 7.2+2

▶NVDibm/maximo_asset_management_essentials6.2, 7.1, 7.5+2

▶NVDibm/maximo_asset_management6.2, 7.1, 7.5+2

▶NVDibm/maximo_service_desk6.2

🔴Vulnerability Details

GHSA

GHSA-r2mg-jvh8-x99r: Cross-site scripting (XSS) vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Es↗2022-05-04

▶

CVEList

CVE-2012-0195: Cross-site scripting (XSS) vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Es↗2012-03-13

▶