cnvd - cnvd-2019-34600

cnvd-2019-34600

Vulnerability from cnvd

Title: IBM Maximo Anywhere信息泄露漏洞（CNVD-2019-34600）

Description:

IBM Maximo Anywhere是美国IBM公司的一套建立在IBM Worklight平台上的下一代移动解决方案。该方案支持通过移动设备远程访问IBM Maximo Asset Management（综合性资产生命周期和维护管理解决方案）的工作流和资产管理。

IBM Maximo Anywhere中存在信息泄露漏洞，该漏洞源于程序未能进行设备root检测，攻击者可利用该漏洞获取有关设备的敏感信息。

Severity: 低

Patch Name: IBM Maximo Anywhere信息泄露漏洞（CNVD-2019-34600）的补丁

Patch Description:

IBM Maximo Anywhere中存在信息泄露漏洞，该漏洞源于程序未能进行设备root检测，攻击者可利用该漏洞获取有关设备的敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/1078995

Reference: https://www.ibm.com/support/pages/node/1078995

Impacted products

Name
['IBM Maximo Anywhere 7.6.2', 'IBM Maximo Anywhere 7.6.3', 'IBM Maximo Anywhere 7.6.1', 'IBM Maximo Anywhere 7.6.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-4265"
    }
  },
  "description": "IBM Maximo Anywhere\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5efa\u7acb\u5728IBM Worklight\u5e73\u53f0\u4e0a\u7684\u4e0b\u4e00\u4ee3\u79fb\u52a8\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u901a\u8fc7\u79fb\u52a8\u8bbe\u5907\u8fdc\u7a0b\u8bbf\u95eeIBM Maximo Asset Management\uff08\u7efc\u5408\u6027\u8d44\u4ea7\u751f\u547d\u5468\u671f\u548c\u7ef4\u62a4\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\uff09\u7684\u5de5\u4f5c\u6d41\u548c\u8d44\u4ea7\u7ba1\u7406\u3002\n\nIBM Maximo Anywhere\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8fdb\u884c\u8bbe\u5907root\u68c0\u6d4b\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6709\u5173\u8bbe\u5907\u7684\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "unknown",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/1078995",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-34600",
  "openTime": "2019-10-11",
  "patchDescription": "IBM Maximo Anywhere\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5efa\u7acb\u5728IBM Worklight\u5e73\u53f0\u4e0a\u7684\u4e0b\u4e00\u4ee3\u79fb\u52a8\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u901a\u8fc7\u79fb\u52a8\u8bbe\u5907\u8fdc\u7a0b\u8bbf\u95eeIBM Maximo Asset Management\uff08\u7efc\u5408\u6027\u8d44\u4ea7\u751f\u547d\u5468\u671f\u548c\u7ef4\u62a4\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\uff09\u7684\u5de5\u4f5c\u6d41\u548c\u8d44\u4ea7\u7ba1\u7406\u3002\r\n\r\nIBM Maximo Anywhere\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8fdb\u884c\u8bbe\u5907root\u68c0\u6d4b\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6709\u5173\u8bbe\u5907\u7684\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Maximo Anywhere\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2019-34600\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Maximo Anywhere 7.6.2",
      "IBM Maximo Anywhere 7.6.3",
      "IBM Maximo Anywhere 7.6.1",
      "IBM Maximo Anywhere 7.6.0"
    ]
  },
  "referenceLink": "https://www.ibm.com/support/pages/node/1078995",
  "serverity": "\u4f4e",
  "submitTime": "2019-10-11",
  "title": "IBM Maximo Anywhere\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2019-34600\uff09"
}

CVE-2019-4265 (GCVE-0-2019-4265)

Vulnerability from cvelistv5

Published

2019-10-10 14:00

Modified

2024-09-17 00:06

Severity ?

2.4 (Low) - CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CWE

Obtain Information

Summary

IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/1078995	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/160198	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Maximo Anywhere	Version: 7.6.0.0 Version: 7.6.1.0 Version: 7.6.2.0 Version: 7.6.2.1 Version: 7.6.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:33:37.764Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/1078995"
          },
          {
            "name": "ibm-maximo-cve20194265-info-disc (160198)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/160198"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maximo Anywhere",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0.0"
            },
            {
              "status": "affected",
              "version": "7.6.1.0"
            },
            {
              "status": "affected",
              "version": "7.6.2.0"
            },
            {
              "status": "affected",
              "version": "7.6.2.1"
            },
            {
              "status": "affected",
              "version": "7.6.3.0"
            }
          ]
        }
      ],
      "datePublic": "2019-10-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 2.1,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/PR:N/I:N/C:L/AV:P/S:U/UI:N/A:N/AC:L/RL:O/RC:C/E:U",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-10T14:00:19",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/1078995"
        },
        {
          "name": "ibm-maximo-cve20194265-info-disc (160198)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/160198"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2019-10-07T00:00:00",
          "ID": "CVE-2019-4265",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Maximo Anywhere",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.6.0.0"
                          },
                          {
                            "version_value": "7.6.1.0"
                          },
                          {
                            "version_value": "7.6.2.0"
                          },
                          {
                            "version_value": "7.6.2.1"
                          },
                          {
                            "version_value": "7.6.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "P",
              "C": "L",
              "I": "N",
              "PR": "N",
              "S": "U",
              "UI": "N"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/1078995",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 1078995 (Maximo Anywhere)",
              "url": "https://www.ibm.com/support/pages/node/1078995"
            },
            {
              "name": "ibm-maximo-cve20194265-info-disc (160198)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/160198"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2019-4265",
    "datePublished": "2019-10-10T14:00:19.786270Z",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-09-17T00:06:45.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted