Strix
26.1K

CVE-2019-4749

MEDIUMCVSS 5.4/10EPSS 0.67%

Last modified

CVE-2019-4749 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. EPSS estimates a 0.67% chance of exploitation in the next 30 days.

Description

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308.

Metrics

CVSS 3.1
5.4/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.67%

47.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
IbmControl Desk7.6.1
IbmControl Desk7.6.1.1
IbmMaximo Asset Configuration Manager7.6.6
IbmMaximo Asset Configuration Manager7.6.7
IbmMaximo Asset Configuration Manager7.6.7.1
IbmMaximo Asset Health Insights7.6.1
IbmMaximo Asset Health Insights7.6.1.1
IbmMaximo Asset Management7.6.1.1
IbmMaximo Asset Management Scheduler7.6.7
IbmMaximo Asset Management Scheduler7.6.7.1
IbmMaximo Asset Management Scheduler7.6.7.3
IbmMaximo Asset Management Scheduler Plus7.6.7
IbmMaximo Asset Management Scheduler Plus7.6.7.1
IbmMaximo Asset Management Scheduler Plus7.6.7.3
IbmMaximo Calibration7.6
IbmMaximo Enterprise Adapter7.6
IbmMaximo Enterprise Adapter7.6.1
IbmMaximo Equipment Maintenance AssistantAll versions
IbmMaximo For Aviation7.6.6
IbmMaximo For Aviation7.6.7
IbmMaximo For Aviation7.6.8
IbmMaximo For Life Sciences7.6
IbmMaximo For Nuclear Power7.6.1
IbmMaximo For Oil And Gas7.6.1
IbmMaximo For Service Providers7.6.3.1
IbmMaximo For Service Providers7.6.3.2
IbmMaximo For Service Providers7.6.3.3
IbmMaximo For Transportation7.6.2.3
IbmMaximo For Transportation7.6.2.4
IbmMaximo For Transportation7.6.2.5
IbmMaximo For Utilities7.6.0.1
IbmMaximo For Utilities7.6.0.2
IbmMaximo Linear Asset Manager7.6.0.1
IbmMaximo Linear Asset Manager7.6.0.2
IbmMaximo Linear Asset Manager7.6.0.3
IbmMaximo Network On Blockchain7.6.0.0
IbmMaximo Network On Blockchain7.6.0.1
IbmMaximo Spatial Asset Management7.6.0.2
IbmMaximo Spatial Asset Management7.6.0.3
IbmMaximo Spatial Asset Management7.6.0.4
IbmMaximo Spatial Asset Management7.6.0.5
IbmTivoli Integration Composer7.6.0.1
IbmTivoli Integration Composer7.6.0.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-4749?
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308.
How severe is CVE-2019-4749?
CVE-2019-4749 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 0.67% probability of exploitation in the next 30 days.
How do I fix CVE-2019-4749?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-4749?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST