CVE-2016-9977
HighSummary
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session.
Risk Assessment
Session hijacking could lead to unauthorized access to sensitive data and operations within the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update IBM Maximo Asset Management to the latest version and implement mechanisms to invalidate session identifiers after use.
Other vulnerabilities in IBM Maximo Asset Management
See all- CVE-2016-9984High
IBM Maximo Asset Management versions 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator.
- CVE-2016-9976High
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server.
- CVE-2017-1175Critical
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Original NVD description (English source)
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253.