Vulnerability Details : CVE-2015-5017
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended access restrictions and establish a login session by entering an expired password.
Products affected by CVE-2015-5017
- cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_asset_management:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_asset_management:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:smartcloud_control_desk:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:smartcloud_control_desk:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:tivoli_service_request_manager:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:tivoli_service_request_manager:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:change_and_configuration_management_database:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:change_and_configuration_management_database:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_government:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_government:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_nuclear_power:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_nuclear_power:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_transportation:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_transportation:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_life_sciences:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_life_sciences:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_utilities:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_utilities:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:maximo_for_energy_optimization:7.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-5017
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-5017
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:N |
8.0
|
4.9
|
NIST | |
|
5.4
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
2.8
|
2.5
|
NIST |
CWE ids for CVE-2015-5017
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-5017
-
http://www-01.ibm.com/support/docview.wss?uid=swg21969052
IBM Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow a user to log in with an expired password (CVE-2015-5017)Vendor Advisory
Jump to