cbcvebase.
CVE-2015-7448
published 2016-03-12

CVE-2015-7448: SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset…

PriorityP337medium5.4CVSS 3.0
AVNACLPRLUINSUCLILAN
EPSS
0.71%
49.4th percentile
SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX003, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Affected

119 ranges· showing 25
VendorProductVersion rangeFixed in
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmchange_and_configuration_management_database——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——
ibmmaximo_asset_management——

CVSS provenance

nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.