CVE-2017-1352 : IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538.

Published 2017-09-12 21:29:00

Updated 2017-09-21 18:38:02

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2017-1352

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-1352

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P	6.8	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
5.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L	2.1	3.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

CWE ids for CVE-2017-1352

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-1352

http://www.ibm.com/support/docview.wss?uid=swg22006650

IBM Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file (CVE-20
Vendor Advisory
http://www.securityfocus.com/bid/100697

IBM Maximo Asset Management CVE-2017-1352 Remote Command Injection Vulnerability
Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126538

IBM Maximo Asset Management command injection CVE-2017-1352 Vulnerability Report
Third Party Advisory;VDB Entry

Products affected by CVE-2017-1352

IBM » Maximo Asset Management » Version: 7.5
cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management » Version: 7.6
cpe:2.3:a:ibm:maximo_asset_management:7.6:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2017-1352

Exploit prediction scoring system (EPSS) score for CVE-2017-1352

CVSS scores for CVE-2017-1352

CWE ids for CVE-2017-1352

References for CVE-2017-1352

Products affected by CVE-2017-1352