IBM Maximo Spatial Asset Management server-side request forgery
CVE-2023-32337

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Maximo Spatial Asset Management
Vendor
CVE Published:
19 January 2024

Summary

IBM Maximo Spatial Asset Management 8.10 is vulnerable to a server-side request forgery (SSRF), which allows an authenticated attacker to transmit unauthorized requests from the server. This vulnerability can lead to network enumeration, potentially exposing sensitive information and enabling an attacker to orchestrate subsequent attacks. The improper validation of requests may result in unauthorized access to internal services, compromising system integrity and security.

Affected Version(s)

Maximo Spatial Asset Management 8.10

References

https://www.ibm.com/support/pages/node/7107712
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/255288
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.