CVE-2016-6072 (GCVE-0-2016-6072)
Vulnerability from cvelistv5 – Published: 2017-02-01 20:00 – Updated: 2024-08-06 01:22
VLAI?
Summary
IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Severity ?
No CVSS data available.
CWE
- Cross-Site Scripting
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM Corporation | Maximo Asset Management |
Affected:
6.2
Affected: 7.1 Affected: 7.5 Affected: 7.5.0.0 Affected: 7.5.0.10 Affected: 7.1.0.0 Affected: 6.2.0.0 Affected: 7.2 Affected: 7.1.1 Affected: 7.1.2 Affected: 7.2.1 Affected: 6.2.1 Affected: 6.2.2 Affected: 6.2.3 Affected: 6.2.4 Affected: 6.2.5 Affected: 6.2.6 Affected: 6.2.7 Affected: 6.2.8 Affected: 7.1.1.1 Affected: 7.1.1.10 Affected: 7.1.1.11 Affected: 7.1.1.12 Affected: 7.1.1.2 Affected: 7.1.1.5 Affected: 7.1.1.6 Affected: 7.1.1.7 Affected: 7.1.1.8 Affected: 7.1.1.9 Affected: 7.5.0.1 Affected: 7.5.0.2 Affected: 7.5.0.3 Affected: 7.5.0.4 Affected: 7.5.0.5 Affected: 7.6 Affected: 7.5.0 Affected: 7.6.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:22:18.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94355",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94355"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg21991893"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Maximo Asset Management",
"vendor": "IBM Corporation",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "7.5"
},
{
"status": "affected",
"version": "7.5.0.0"
},
{
"status": "affected",
"version": "7.5.0.10"
},
{
"status": "affected",
"version": "7.1.0.0"
},
{
"status": "affected",
"version": "6.2.0.0"
},
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.1.1"
},
{
"status": "affected",
"version": "7.1.2"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "6.2.1"
},
{
"status": "affected",
"version": "6.2.2"
},
{
"status": "affected",
"version": "6.2.3"
},
{
"status": "affected",
"version": "6.2.4"
},
{
"status": "affected",
"version": "6.2.5"
},
{
"status": "affected",
"version": "6.2.6"
},
{
"status": "affected",
"version": "6.2.7"
},
{
"status": "affected",
"version": "6.2.8"
},
{
"status": "affected",
"version": "7.1.1.1"
},
{
"status": "affected",
"version": "7.1.1.10"
},
{
"status": "affected",
"version": "7.1.1.11"
},
{
"status": "affected",
"version": "7.1.1.12"
},
{
"status": "affected",
"version": "7.1.1.2"
},
{
"status": "affected",
"version": "7.1.1.5"
},
{
"status": "affected",
"version": "7.1.1.6"
},
{
"status": "affected",
"version": "7.1.1.7"
},
{
"status": "affected",
"version": "7.1.1.8"
},
{
"status": "affected",
"version": "7.1.1.9"
},
{
"status": "affected",
"version": "7.5.0.1"
},
{
"status": "affected",
"version": "7.5.0.2"
},
{
"status": "affected",
"version": "7.5.0.3"
},
{
"status": "affected",
"version": "7.5.0.4"
},
{
"status": "affected",
"version": "7.5.0.5"
},
{
"status": "affected",
"version": "7.6"
},
{
"status": "affected",
"version": "7.5.0"
},
{
"status": "affected",
"version": "7.6.0"
}
]
}
],
"datePublic": "2017-02-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-02-02T10:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "94355",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94355"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg21991893"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2016-6072",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Maximo Asset Management",
"version": {
"version_data": [
{
"version_value": "6.2"
},
{
"version_value": "7.1"
},
{
"version_value": "7.5"
},
{
"version_value": "7.5.0.0"
},
{
"version_value": "7.5.0.10"
},
{
"version_value": "7.1.0.0"
},
{
"version_value": "6.2.0.0"
},
{
"version_value": "7.2"
},
{
"version_value": "7.1.1"
},
{
"version_value": "7.1.2"
},
{
"version_value": "7.2.1"
},
{
"version_value": "6.2.1"
},
{
"version_value": "6.2.2"
},
{
"version_value": "6.2.3"
},
{
"version_value": "6.2.4"
},
{
"version_value": "6.2.5"
},
{
"version_value": "6.2.6"
},
{
"version_value": "6.2.7"
},
{
"version_value": "6.2.8"
},
{
"version_value": "7.1.1.1"
},
{
"version_value": "7.1.1.10"
},
{
"version_value": "7.1.1.11"
},
{
"version_value": "7.1.1.12"
},
{
"version_value": "7.1.1.2"
},
{
"version_value": "7.1.1.5"
},
{
"version_value": "7.1.1.6"
},
{
"version_value": "7.1.1.7"
},
{
"version_value": "7.1.1.8"
},
{
"version_value": "7.1.1.9"
},
{
"version_value": "7.5.0.1"
},
{
"version_value": "7.5.0.2"
},
{
"version_value": "7.5.0.3"
},
{
"version_value": "7.5.0.4"
},
{
"version_value": "7.5.0.5"
},
{
"version_value": "7.6"
},
{
"version_value": "7.5.0"
},
{
"version_value": "7.6.0"
}
]
}
}
]
},
"vendor_name": "IBM Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94355",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94355"
},
{
"name": "http://www.ibm.com/support/docview.wss?uid=swg21991893",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21991893"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2016-6072",
"datePublished": "2017-02-01T20:00:00",
"dateReserved": "2016-06-29T00:00:00",
"dateUpdated": "2024-08-06T01:22:18.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_asset_management:7.6.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B028794E-5FA0-4E3D-AC4D-A2826DD6282C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_for_aviation:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3823051F-FD38-4874-8692-9744B82E65A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_for_life_sciences:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0660482-340B-4FDA-8F0A-323BE0167800\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_for_nuclear_power:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C0E7B2B1-2746-40A4-83FC-DCEDE8B607BA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_for_oil_and_gas:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"55DB8F6D-F7DB-485B-80D9-368188F2E858\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_for_transportation:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"537D5FEA-7809-4CB6-9D71-FC3C408B2611\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:maximo_for_utilities:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EEE303C7-7873-4754-926D-122FD45337FB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:smartcloud_control_desk:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"742BF86E-E5D2-4CC9-BD41-78C243995880\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:tivoli_asset_management_for_it:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"54804AB9-79D4-45F8-98A3-B7D441849321\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:tivoli_change_and_configuration_management_database:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"82C3D17D-CAA1-4ACE-9FF1-76FC9735ED67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:tivoli_integration_composer:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"173EC315-107C-47DA-ADD3-2FF91412B52E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:tivoli_service_request_manager:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"57A2B9AC-D5F8-4143-B1A5-4E26CCBCB3E2\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.\"}, {\"lang\": \"es\", \"value\": \"IBM Maximo Asset Management es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar c\\u00f3digo JavaScript arbitrario en la IU Web alterando as\\u00ed la funcionalidad prevista que potencialmente conduce a la divulgaci\\u00f3n de credenciales dentro de una sesi\\u00f3n de confianza.\"}]",
"id": "CVE-2016-6072",
"lastModified": "2024-11-21T02:55:24.900",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2017-02-01T20:59:02.177",
"references": "[{\"url\": \"http://www.ibm.com/support/docview.wss?uid=swg21991893\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/94355\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.ibm.com/support/docview.wss?uid=swg21991893\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/94355\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-6072\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2017-02-01T20:59:02.177\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.\"},{\"lang\":\"es\",\"value\":\"IBM Maximo Asset Management es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar c\u00f3digo JavaScript arbitrario en la IU Web alterando as\u00ed la funcionalidad prevista que potencialmente conduce a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_asset_management:7.6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B028794E-5FA0-4E3D-AC4D-A2826DD6282C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_for_aviation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3823051F-FD38-4874-8692-9744B82E65A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_for_life_sciences:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0660482-340B-4FDA-8F0A-323BE0167800\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_for_nuclear_power:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0E7B2B1-2746-40A4-83FC-DCEDE8B607BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_for_oil_and_gas:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55DB8F6D-F7DB-485B-80D9-368188F2E858\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_for_transportation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"537D5FEA-7809-4CB6-9D71-FC3C408B2611\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_for_utilities:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EEE303C7-7873-4754-926D-122FD45337FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:smartcloud_control_desk:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"742BF86E-E5D2-4CC9-BD41-78C243995880\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:tivoli_asset_management_for_it:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54804AB9-79D4-45F8-98A3-B7D441849321\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:tivoli_change_and_configuration_management_database:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82C3D17D-CAA1-4ACE-9FF1-76FC9735ED67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:tivoli_integration_composer:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"173EC315-107C-47DA-ADD3-2FF91412B52E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:tivoli_service_request_manager:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"57A2B9AC-D5F8-4143-B1A5-4E26CCBCB3E2\"}]}]}],\"references\":[{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg21991893\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/94355\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg21991893\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/94355\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…