Medium WID-SEC-2023-0881 3 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Apr 5, 2023 · Updated Apr 5, 2023 · de-DE

Vendor: IBM Product: Maximo Asset Management Product: Maximo Asset Management 7.6.1.2 Product: Maximo Asset Management 7.6.1.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um Informationen offenzulegen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 3

High 7.5

CVE-2022-40146 Public exploit

Jar url should be blocked by DefaultScriptSecurity

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven

Sep 22, 2022
Medium 5.3

CVE-2022-38398

Server-Side Request Forgery Information Disclosure Vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven

Sep 22, 2022
Medium 5.3

CVE-2022-38648

PDFTranscoder does not block external resources

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven

Sep 22, 2022

Revision history

2023-04-05 #1
Initiale Fassung

References

IBM Security Bulletin 6981109 vom 2023-04-05
https://www.ibm.com/support/pages/node/6981109