CVE-2015-5051

IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21970797	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:maximo_asset_management:7.5:::::::*
	cpe:2.3:a:ibm:maximo_asset_management:7.6:::::::*
	cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:::::::*
	cpe:2.3:a:ibm:maximo_asset_management_essentials:7.6:::::::*
	cpe:2.3:a:ibm:maximo_for_government:7.5:::::::*
	cpe:2.3:a:ibm:maximo_for_life_sciences:7.5:::::::*
	cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:::::::*
	cpe:2.3:a:ibm:maximo_for_nuclear_power:7.5:::::::*
	cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.5:::::::*
	cpe:2.3:a:ibm:maximo_for_transportation:7.5:::::::*
	cpe:2.3:a:ibm:maximo_for_utilities:7.5:::::::*
	cpe:2.3:a:ibm:smartcloud_control_desk:7.5:::::::*
	cpe:2.3:a:ibm:smartcloud_control_desk:7.6:::::::*

History

No history.

Information

Published : 2016-01-03 05:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-5051

Mitre link : CVE-2015-5051

CVE.ORG link : CVE-2015-5051

JSON object : View

Products Affected

ibm

maximo_for_government
maximo_asset_management_essentials
maximo_for_oil_and_gas
maximo_for_utilities
maximo_asset_management
maximo_for_life_sciences
maximo_for_nuclear_power
maximo_for_transportation
smartcloud_control_desk

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-5051", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2016-01-03T05:59:09.990", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21970797", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors."}, {"lang": "es", "value": "IBM Maximo Asset Management 7.5 en versiones anteriores a 7.5.0.8 IF6 y 7.6 en versiones anteriores a 7.6.0.2 IF1 y Maximo Asset Management 7.5 en versiones anteriores a 7.5.0.8 IF6, 7.5.1 y 7.6 en versiones anteriores a 7.6.0.2 IF1 para SmartCloud Control Desk permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso en resultados de consulta a trav\u00e9s de vectores no especificados."}], "lastModified": "2016-01-06T18:16:07.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1AEBAE48-FFD0-4837-AB3B-F6C31B1AC8D9"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58B773C7-9386-4704-B85F-748578DBC242"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "598EAB6C-7D41-46FE-BB32-D31014CA01D6"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management_essentials:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB43A8FB-E429-4BD4-8787-E538352D8D9B"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_government:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4908AC9D-7410-47A6-BC46-5587C60061A2"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_life_sciences:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "360D781D-AD52-4309-A484-2150B10DFB02"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BA294D6-4D4D-4ADB-A05B-F578A8877A4D"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_nuclear_power:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75C69BA7-055F-446B-9E76-398D57680BA0"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "012787EB-E7F0-4CAD-B406-6057A7F6F14F"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_transportation:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4367602D-5736-459D-82C1-099CD484F2FE"}, {"criteria": "cpe:2.3:a:ibm:maximo_for_utilities:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1480E9F7-9CA1-4F8D-977F-0F13594D0D36"}, {"criteria": "cpe:2.3:a:ibm:smartcloud_control_desk:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88692CEA-1B67-4D1D-86CF-FC0C6DDB2B27"}, {"criteria": "cpe:2.3:a:ibm:smartcloud_control_desk:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9FC166C-B9B7-4DD9-B22E-174247578F16"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}