CVE-2016-9976
HighSummary
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server.
Risk Assessment
This vulnerability poses a serious security risk as it allows remote code execution, potentially leading to full control over the server.
Recommendation
It is recommended to update to the latest version of IBM Maximo Asset Management and implement appropriate security measures to mitigate the risk of attack.
Other vulnerabilities in IBM Maximo Asset Management
See all- CVE-2016-9984High
IBM Maximo Asset Management versions 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator.
- CVE-2016-9977High
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session.
- CVE-2017-1175Critical
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Original NVD description (English source)
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252.