Strix
26.1K

CVE-2020-4409

HIGHCVSS 8.2/10EPSS 0.89%

Last modified

CVE-2020-4409 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. EPSS estimates a 0.89% chance of exploitation in the next 30 days.

Description

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537.

Metrics

CVSS 3.1
8.2/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS Probability
0.89%

54.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
IbmControl Desk7.6.1
IbmControl Desk7.6.1.1
IbmMaximo Asset Configuration Manager7.6.6
IbmMaximo Asset Configuration Manager7.6.7
IbmMaximo Asset Configuration Manager7.6.7.1
IbmMaximo Asset Health Insights7.6.1
IbmMaximo Asset Health Insights7.6.1.1
IbmMaximo Asset Management< 7.6.1.2
IbmMaximo Asset Management Scheduler7.6.7
IbmMaximo Asset Management Scheduler7.6.7.1
IbmMaximo Asset Management Scheduler7.6.7.3
IbmMaximo Asset Management Scheduler Plus7.6.7
IbmMaximo Asset Management Scheduler Plus7.6.7.1
IbmMaximo Asset Management Scheduler Plus7.6.7.3
IbmMaximo Calibration7.6
IbmMaximo Enterprise Adapter7.6
IbmMaximo Enterprise Adapter7.6.1
IbmMaximo Equipment Maintenance AssistantAll versions
IbmMaximo For Aviation7.6.6
IbmMaximo For Aviation7.6.7
IbmMaximo For Aviation7.6.8
IbmMaximo For Life Sciences7.6
IbmMaximo For Nuclear Power7.6.1
IbmMaximo For Oil And Gas7.6.1
IbmMaximo For Service Providers7.6.3.1
IbmMaximo For Service Providers7.6.3.2
IbmMaximo For Service Providers7.6.3.3
IbmMaximo For Transportation7.6.2.3
IbmMaximo For Transportation7.6.2.4
IbmMaximo For Transportation7.6.2.5
IbmMaximo For Utilities7.6.0.1
IbmMaximo For Utilities7.6.0.2
IbmMaximo Linear Asset Manager7.6.0
IbmMaximo Linear Asset Manager7.6.0.2
IbmMaximo Linear Asset Manager7.6.0.3
IbmMaximo Network On Blockchain7.6.0.0
IbmMaximo Network On Blockchain7.6.0.1
IbmMaximo Spatial Asset Management7.6.0.2
IbmMaximo Spatial Asset Management7.6.0.3
IbmMaximo Spatial Asset Management7.6.0.4
IbmMaximo Spatial Asset Management7.6.0.5
IbmTivoli Integration Composer7.6

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-4409?
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537.
How severe is CVE-2020-4409?
CVE-2020-4409 has a CVSS score of 8.2/10 (HIGH severity). The EPSS model estimates a 0.89% probability of exploitation in the next 30 days.
How do I fix CVE-2020-4409?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-4409?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST