CVE-2022-35281 - IBM Maximo Application Suite command injection

Back Back to CVE browser

HIGH

IBM Maximo Application Suite command injection

Published Jan 6, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.51%

Description

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.

Affected products

Vendor IBM Product Maximo Asset Management Default
unaffected
- Version
  7.6.1.1, 7.6.1.2, 7.6.1.3
  Status
  affected
  Constraints
  -
Vendor IBM Product Maximo Manage Default
unaffected
- Version
  8.3, 8.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Maximo Asset Management

unaffected

Version	Status	Constraints
7.6.1.1, 7.6.1.2, 7.6.1.3	affected	-

IBM

Maximo Manage

unaffected

Version	Status	Constraints
8.3, 8.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1236

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38171
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/230635
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6852669
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38171		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/230635		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6852669		vendor-advisoryVendor Advisory