CVE-2011-1394
Last modified
CVE-2011-1394 is a vulnerability of currently unknown severity. IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allow remote attackers to cause a denial of service (memory consumption) by establishing many UI sessions within one HTTP session.. EPSS estimates a 2.58% chance of exploitation in the next 30 days.
Description
IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allow remote attackers to cause a denial of service (memory consumption) by establishing many UI sessions within one HTTP session.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Maximo Asset Management | 6.2 |
| Ibm | Maximo Asset Management | 7.1 |
| Ibm | Maximo Asset Management | 7.5 |
| Ibm | Maximo Asset Management Essentials | 6.2 |
| Ibm | Maximo Asset Management Essentials | 7.1 |
| Ibm | Maximo Asset Management Essentials | 7.5 |
| Ibm | Tivoli Asset Management For It | 6.2 |
| Ibm | Tivoli Asset Management For It | 7.1 |
| Ibm | Tivoli Asset Management For It | 7.2 |
| Ibm | Trivoli Service Request Manager | 7.1 |
| Ibm | Trivoli Service Request Manager | 7.2 |
| Ibm | Maximo Service Desk | 6.2 |
| Ibm | Tivoli Change And Configuration Management Database | 6.2 |
| Ibm | Tivoli Change And Configuration Management Database | 7.1 |
| Ibm | Tivoli Change And Configuration Management Database | 7.2 |
References
- http://www.ibm.com/support/docview.wss?uid=swg21584666Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg21584666Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-1394?
How severe is CVE-2011-1394?
How do I fix CVE-2011-1394?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-1388The Blueberry FlashBack ActiveX control in BB FlashBack Reco…
- CVE-2011-1389Multiple directory traversal vulnerabilities in the vendor d…
- CVE-2011-1390SQL injection vulnerability in the Maintenance tool in IBM R…
- CVE-2011-1391The Blueberry FlashBack ActiveX control in BB FlashBack Reco…
- CVE-2011-1392The Blueberry FlashBack ActiveX control in BB FlashBack Reco…
- CVE-2011-1393Unspecified vulnerability in the authentication functionalit…
- CVE-2011-1395Cross-site scripting (XSS) vulnerability in imicon.jsp in IB…
- CVE-2011-1396Cross-site scripting (XSS) vulnerability in IBM Maximo Asset…
- CVE-2011-1397Cross-site request forgery (CSRF) vulnerability in the Labor…
- CVE-2011-1398The sapi_header_op function in main/SAPI.c in PHP before 5.3…
- CVE-2011-1400The default configuration of the shell_escape_commands direc…
- CVE-2011-1401ikiwiki before 3.20110328 does not ascertain whether the htm…
Are you affected by CVE-2011-1394?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST