Medium WID-SEC-2024-0088 5 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen

Published Jan 15, 2024 · Updated Jan 15, 2024 · de-DE

Vendor: IBM Product: Maximo Asset Management 7.6.1 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder beliebigen Programmcode auszuführen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 5

High 8.7

CVE-2021-22573

Incorrect signature verification on Google-oauth-java-client

The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payloa…

Google Google-oauth-java-client google-oauth-client-java com.google.oauth-client:google-oauth-client Debian Ubuntu Maven

May 3, 2022
High 7.4

CVE-2020-7692

Improper Authorization

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization requ…

com.google.oauth-client:google-oauth-client google-oauth-client-java google-oauth-client-java Debian Ubuntu Maven

Jul 9, 2020
High 7.1

CVE-2022-44729

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource…

Apache Software Foundation Apache XML Graphics Batik batik batik Debian Ubuntu Maven

Aug 22, 2023
Medium 4.4

CVE-2022-44730

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

Apache Software Foundation Apache XML Graphics Batik batik batik Debian Ubuntu Maven

Aug 22, 2023
Medium 4.3

CVE-2023-47718

IBM Maximo Asset Management cross-site request forgery

IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10 through 8.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID:…

IBM Maximo Asset Management Maximo Asset Management Manage Component

Jan 19, 2024

Revision history

2024-01-15 #1
Initiale Fassung

References

IBM Security Bulletin: 7107714 vom 2024-01-15
https://www.ibm.com/support/pages/node/7107714
IBM Security Bulletin: 7107738 vom 2024-01-15
https://www.ibm.com/support/pages/node/7107738
IBM Security Bulletin: 7107741 vom 2024-01-15
https://www.ibm.com/support/pages/node/7107741
IBM Security Bulletin: 7107715 vom 2024-01-15
https://www.ibm.com/support/pages/node/7107715