CVE-2015-1933 in Maximo Asset Management
Summary
by MITRE
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/18/2018
This vulnerability exists in IBM Maximo Asset Management versions 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001 across multiple product lines including SmartCloud Control Desk and Tivoli IT Asset Management for IT. The core technical flaw involves the absence of the autocomplete="off" attribute on password input fields within the web interface, creating a significant security weakness that directly impacts authentication security mechanisms. This vulnerability is classified as a weakness in the user interface design where the application fails to properly disable browser autocomplete functionality for sensitive credential fields, making it easier for attackers to exploit.
The operational impact of this vulnerability is substantial as it enables remote attackers to leverage unattended workstations for unauthorized access. When a user leaves their workstation unattended while logged into Maximo Asset Management, the browser's autocomplete feature can store and automatically fill in previously entered passwords, including the password field that lacks the proper autocomplete="off" attribute. This creates a vector for credential theft attacks where attackers can simply return to an unattended workstation and gain access to the application without needing to perform additional authentication challenges. The vulnerability specifically targets the password field in the authentication process, which is a critical security control point.
This weakness maps to CWE-384 in the CWE dictionary, which specifically addresses the issue of storing sensitive information in a manner that is accessible to unauthorized parties. The vulnerability also aligns with ATT&CK technique T1566 which covers credential access through social engineering and physical access methods, particularly targeting unattended systems. The security implications extend beyond simple credential theft to include potential privilege escalation and unauthorized access to asset management data, as Maximo Asset Management contains sensitive business-critical information about enterprise assets and their maintenance schedules.
Organizations should implement immediate mitigations including applying the relevant IFIX patches released by IBM for the affected versions, manually adding the autocomplete="off" attribute to password fields in the application configuration, and implementing additional security controls such as automatic session timeout mechanisms. System administrators should also consider implementing workstation security policies that enforce automatic screen locking after periods of inactivity, as well as educating users about the risks of leaving workstations unattended. The vulnerability demonstrates the importance of proper web application security configuration and highlights how seemingly minor UI elements can create significant security risks in enterprise applications.