cnvd - cnvd-2024-19026

cnvd-2024-19026

Vulnerability from cnvd

Title: IBM Maximo Application Suite和IBM Maximo Application Suite信息泄露漏洞

Description:

IBM Maximo Asset Management和IBM Maximo Application Suite都是美国国际商业机器（IBM）公司的产品。IBM Maximo Asset Management是一套综合性资产生命周期和维护管理解决方案。该方案能够在一个平台上管理所有类型的资产，如设施、交通运输等，并对这些资产实现单点控制。IBM Maximo Application Suite是一个为智能资产管理、监控、维护、计算机视觉、安全性和可靠性提供的单一平台。

IBM Maximo Application Suite和IBM Maximo Application Suite存在信息泄露漏洞，攻击者可利用该漏洞通过服务器日志、引荐头或浏览器历史访问url，导致信息泄露。

Severity: 低

Patch Name: IBM Maximo Application Suite和IBM Maximo Application Suite信息泄露漏洞的补丁

Patch Description:

IBM Maximo Application Suite和IBM Maximo Application Suite存在信息泄露漏洞，攻击者可利用该漏洞通过服务器日志、引荐头或浏览器历史访问url，导致信息泄露。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7138684

Reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/266875

Impacted products

Name
['IBM Maximo Asset Management 7.6.1.3', 'IBM IBM Maximo Application Suite 8.10', 'IBM IBM Maximo Application Suite 8.11']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-32335"
    }
  },
  "description": "IBM Maximo Asset Management\u548cIBM Maximo Application Suite\u90fd\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM Maximo Asset Management\u662f\u4e00\u5957\u7efc\u5408\u6027\u8d44\u4ea7\u751f\u547d\u5468\u671f\u548c\u7ef4\u62a4\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u5728\u4e00\u4e2a\u5e73\u53f0\u4e0a\u7ba1\u7406\u6240\u6709\u7c7b\u578b\u7684\u8d44\u4ea7\uff0c\u5982\u8bbe\u65bd\u3001\u4ea4\u901a\u8fd0\u8f93\u7b49\uff0c\u5e76\u5bf9\u8fd9\u4e9b\u8d44\u4ea7\u5b9e\u73b0\u5355\u70b9\u63a7\u5236\u3002IBM Maximo Application Suite\u662f\u4e00\u4e2a\u4e3a\u667a\u80fd\u8d44\u4ea7\u7ba1\u7406\u3001\u76d1\u63a7\u3001\u7ef4\u62a4\u3001\u8ba1\u7b97\u673a\u89c6\u89c9\u3001\u5b89\u5168\u6027\u548c\u53ef\u9760\u6027\u63d0\u4f9b\u7684\u5355\u4e00\u5e73\u53f0\u3002\n\nIBM Maximo Application Suite\u548cIBM Maximo Application Suite\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u670d\u52a1\u5668\u65e5\u5fd7\u3001\u5f15\u8350\u5934\u6216\u6d4f\u89c8\u5668\u5386\u53f2\u8bbf\u95eeurl\uff0c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7138684",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-19026",
  "openTime": "2024-04-22",
  "patchDescription": "IBM Maximo Asset Management\u548cIBM Maximo Application Suite\u90fd\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM Maximo Asset Management\u662f\u4e00\u5957\u7efc\u5408\u6027\u8d44\u4ea7\u751f\u547d\u5468\u671f\u548c\u7ef4\u62a4\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u5728\u4e00\u4e2a\u5e73\u53f0\u4e0a\u7ba1\u7406\u6240\u6709\u7c7b\u578b\u7684\u8d44\u4ea7\uff0c\u5982\u8bbe\u65bd\u3001\u4ea4\u901a\u8fd0\u8f93\u7b49\uff0c\u5e76\u5bf9\u8fd9\u4e9b\u8d44\u4ea7\u5b9e\u73b0\u5355\u70b9\u63a7\u5236\u3002IBM Maximo Application Suite\u662f\u4e00\u4e2a\u4e3a\u667a\u80fd\u8d44\u4ea7\u7ba1\u7406\u3001\u76d1\u63a7\u3001\u7ef4\u62a4\u3001\u8ba1\u7b97\u673a\u89c6\u89c9\u3001\u5b89\u5168\u6027\u548c\u53ef\u9760\u6027\u63d0\u4f9b\u7684\u5355\u4e00\u5e73\u53f0\u3002\r\n\r\nIBM Maximo Application Suite\u548cIBM Maximo Application Suite\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u670d\u52a1\u5668\u65e5\u5fd7\u3001\u5f15\u8350\u5934\u6216\u6d4f\u89c8\u5668\u5386\u53f2\u8bbf\u95eeurl\uff0c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Maximo Application Suite\u548cIBM Maximo Application Suite\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Maximo Asset Management 7.6.1.3",
      "IBM IBM Maximo Application Suite 8.10",
      "IBM IBM Maximo Application Suite 8.11"
    ]
  },
  "referenceLink": "https://exchange.xforce.ibmcloud.com/vulnerabilities/266875",
  "serverity": "\u4f4e",
  "submitTime": "2024-03-15",
  "title": "IBM Maximo Application Suite\u548cIBM Maximo Application Suite\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2023-32335 (GCVE-0-2023-32335)

Vulnerability from cvelistv5

Published

2024-03-13 09:23

Modified

2024-08-05 15:52

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-598 - Information Exposure Through Query Strings in GET Request

Summary

IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 255075.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/7138684	vendor-advisory
	https://exchange.xforce.ibmcloud.com/vulnerabilities/266875	vdb-entry
	https://www.ibm.com/support/pages/node/7138686	vendor-advisory

Impacted products

Vendor

Product

Version

▼

IBM

Maximo Application Suite

Version: 8.10, 8.11

IBM

Maximo Asset Management

Version: 7.6.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:10:24.953Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7138684"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/266875"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7138686"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-32335",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T15:52:09.104397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:52:20.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Maximo Application Suite",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.10, 8.11"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Maximo Asset Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.  IBM X-Force ID:  255075."
            }
          ],
          "value": "IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.  IBM X-Force ID:  255075."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598 Information Exposure Through Query Strings in GET Request",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-13T09:23:23.225Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7138684"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/266875"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7138686"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Maximo Application Suite information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2023-32335",
    "datePublished": "2024-03-13T09:23:23.225Z",
    "dateReserved": "2023-05-08T18:32:34.088Z",
    "dateUpdated": "2024-08-05T15:52:20.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted