CVE-2017-1175
CriticalSummary
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Risk Assessment
This vulnerability poses a serious risk to the integrity and confidentiality of data within the organization, allowing attackers unauthorized access to sensitive information.
Recommendation
It is recommended to upgrade to the latest version of IBM Maximo Asset Management and implement appropriate security measures to mitigate the risk of SQL injection attacks.
Other vulnerabilities in IBM Maximo Asset Management
See all- CVE-2016-9984High
IBM Maximo Asset Management versions 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator.
- CVE-2016-9977High
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session.
- CVE-2016-9976High
IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server.
Original NVD description (English source)
IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 123297.