CVE-2015-7451

Опубликовано: 02 янв. 2016

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg21972423
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972423
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_asset_management:7.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_government:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_life_sciences:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_nuclear_power:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_transportation:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:maximo_for_utilities:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:smartcloud_control_desk:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:smartcloud_control_desk:7.6:*:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00168

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-rxxj-2cx7-34wq