IBM Maximo Asset Management up to 7.11.13/7.5.0.9/7.6.0.3 Log information disclosure

Summaryinfo

A vulnerability categorized as problematic has been discovered in IBM Maximo Asset Management up to 7.11.13/7.5.0.9/7.6.0.3. This affects an unknown function. Executing a manipulation can lead to information disclosure (Log). The identification of this vulnerability is CVE-2015-7487. The attack can only be executed locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in IBM Maximo Asset Management up to 7.11.13/7.5.0.9/7.6.0.3 (Asset Management Software). This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a information disclosure vulnerability (Log). The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow local users to obtain sensitive information by leveraging administrative privileges and reading log files.

The weakness was shared 01/27/2016 (Website). The advisory is shared for download at www-01.ibm.com. This vulnerability was named CVE-2015-7487 since 09/29/2015. The attack needs to be approached locally. The successful exploitation needs a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Asset Management Software

Vendor

• IBM

Name

• Maximo Asset Management

Version

• 7.5.0.0
• 7.5.0.1
• 7.5.0.2
• 7.5.0.3
• 7.5.0.4
• 7.5.0.5
• 7.5.0.6
• 7.5.0.7
• 7.5.0.8
• 7.5.0.9
• 7.6.0.0
• 7.6.0.1
• 7.6.0.2
• 7.6.0.3
• 7.11.0
• 7.11.1
• 7.11.2
• 7.11.3
• 7.11.4
• 7.11.5
• 7.11.6
• 7.11.7
• 7.11.8
• 7.11.9
• 7.11.10
• 7.11.11
• 7.11.12
• 7.11.13

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion