CVE-2015-0104
published 2017-04-24CVE-2015-0104: IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo…
PriorityP265high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
6.85%
93.3th percentile
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to execute arbitrary code via unspecified vectors.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | change_and_configuration_management_database | — | — |
| ibm | change_and_configuration_management_database | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management_essentials | — | — |
| ibm | maximo_for_government | — | — |
| ibm | maximo_for_life_sciences | — | — |
| ibm | maximo_for_nuclear_power | — | — |
| ibm | maximo_for_oil_and_gas | — | — |
| ibm | maximo_for_transportation | — | — |
| ibm | maximo_for_utilities | — | — |
| ibm | tivoli_asset_management_for_it | — | — |
| ibm | tivoli_asset_management_for_it | — | — |
| ibm | tivoli_service_request_manager | — | — |
| ibm | tivoli_service_request_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://site/maximo/report?__document=/system/path/web/root/shell.jsp&__report=&appname=&__requestid=&reportNum=↗
- →Monitor HTTP POST requests to /maximo/report containing the __document parameter with a path pointing to a .jsp file, which indicates an attempt to write a web shell via the report endpoint. ↗
- →Detect SOAP requests to the Maximo report endpoint where the __document parameter traverses to a web-accessible directory (e.g., web/root/) and specifies a JSP filename — this is the mechanism used to drop the web shell. ↗
- →Alert on the creation of any new .jsp files under the Maximo web root directory, as the exploit writes a JSP web shell to a path controlled by the __document parameter. ↗
- ·The exploit requires the attacker to be a remote authenticated user; unauthenticated exploitation is not possible per the CVE description. ↗
- ·The __document parameter in the SOAP/report request accepts a server-side file system path, meaning the web shell destination is fully attacker-controlled; restrict or validate this parameter server-side. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p22g-469r-3wx4: IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7
ghsa_unreviewed·2022-05-17
CVE-2015-0104 [HIGH] CWE-284 GHSA-p22g-469r-3wx4: IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to execute arbitrary code via unspecified vectors.
GHSA
GHSA-2357-2qjp-rwfg: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7
ghsa_unreviewed·2022-05-17·CVSS 8.8
CVE-2015-0108 [HIGH] CWE-79 GHSA-2357-2qjp-rwfg: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0109.
GHSA
GHSA-3c4f-jhr6-22q6: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7
ghsa_unreviewed·2022-05-17·CVSS 8.8
CVE-2015-0109 [HIGH] CWE-79 GHSA-3c4f-jhr6-22q6: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0108.
No detection rules found.
No writeups or analysis indexed.
2017-04-24
Published