CVE-2019-4446 : IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifyin

IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.

Published 2020-04-17 14:15:18

Updated 2021-07-21 11:39:24

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-4446

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 17 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-4446

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N	8.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	2.8	2.5	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	2.8	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

References for CVE-2019-4446

https://www.ibm.com/support/pages/node/6190215

Security Bulletin: IBM Maximo Asset Management is vulnerable to Insecure Permissions (CVE-2019-4446)
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/163490

IBM Maximo Asset Management insecure permissions CVE-2019-4446 Vulnerability Report
VDB Entry;Vendor Advisory

Products affected by CVE-2019-4446

IBM » Maximo Asset Management » Version: 7.6.1.1
cpe:2.3:a:ibm:maximo_asset_management:7.6.1.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management » Version: 7.6.1
cpe:2.3:a:ibm:maximo_asset_management:7.6.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management » Version: 7.6.0
cpe:2.3:a:ibm:maximo_asset_management:7.6.0:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Nuclear Power » Version: 7.6.1
cpe:2.3:a:ibm:maximo_for_nuclear_power:7.6.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Transportation » Version: 7.6.2.3
cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.3:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Transportation » Version: 7.6.2.4
cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.4:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Transportation » Version: 7.6.2.5
cpe:2.3:a:ibm:maximo_for_transportation:7.6.2.5:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Life Sciences » Version: 7.6
cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Oil And Gas » Version: 7.6.1
cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.6.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Utilities » Version: 7.6.0.1
cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Utilities » Version: 7.6.0.2
cpe:2.3:a:ibm:maximo_for_utilities:7.6.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Aviation » Version: 7.6.6
cpe:2.3:a:ibm:maximo_for_aviation:7.6.6:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Aviation » Version: 7.6.7
cpe:2.3:a:ibm:maximo_for_aviation:7.6.7:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Aviation » Version: 7.6.8
cpe:2.3:a:ibm:maximo_for_aviation:7.6.8:*:*:*:*:*:*:*
Matching versions
IBM » Tivoli Integration Composer » Version: 7.6
cpe:2.3:a:ibm:tivoli_integration_composer:7.6:*:*:*:*:*:*:*
Matching versions
IBM » Control Desk » Version: 7.6.1
cpe:2.3:a:ibm:control_desk:7.6.1:*:*:*:*:*:*:*
Matching versions
IBM » Control Desk » Version: 7.6.1.1
cpe:2.3:a:ibm:control_desk:7.6.1.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Configuration Manager » Version: 7.6.6
cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.6:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Configuration Manager » Version: 7.6.7
cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Configuration Manager » Version: 7.6.7.1
cpe:2.3:a:ibm:maximo_asset_configuration_manager:7.6.7.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Health Insights » Version: 7.6.1
cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Health Insights » Version: 7.6.1.1
cpe:2.3:a:ibm:maximo_asset_health_insights:7.6.1.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management Scheduler » Version: 7.6.7
cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management Scheduler » Version: 7.6.7.1
cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management Scheduler » Version: 7.6.7.3
cpe:2.3:a:ibm:maximo_asset_management_scheduler:7.6.7.3:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management Scheduler Plus » Version: 7.6.7
cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management Scheduler Plus » Version: 7.6.7.1
cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Asset Management Scheduler Plus » Version: 7.6.7.3
cpe:2.3:a:ibm:maximo_asset_management_scheduler_plus:7.6.7.3:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Calibration » Version: 7.6
cpe:2.3:a:ibm:maximo_calibration:7.6:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Enterprise Adapter » Version: 7.6
cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Enterprise Adapter » Version: 7.6.1
cpe:2.3:a:ibm:maximo_enterprise_adapter:7.6.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Equipment Maintenance Assistant On-premises » Version: N/A
cpe:2.3:a:ibm:maximo_equipment_maintenance_assistant_on-premises:-:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Service Providers » Version: 7.6.3.1
cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Service Providers » Version: 7.6.3.2
cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.2:*:*:*:*:*:*:*
Matching versions
IBM » Maximo For Service Providers » Version: 7.6.3.3
cpe:2.3:a:ibm:maximo_for_service_providers:7.6.3.3:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Linear Asset Manager » Version: 7.6.0.1
cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Linear Asset Manager » Version: 7.6.0.2
cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Linear Asset Manager » Version: 7.6.0.3
cpe:2.3:a:ibm:maximo_linear_asset_manager:7.6.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Network On Blockchain » Version: 7.6.0.0
cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Maximo Network On Blockchain » Version: 7.6.0.1
cpe:2.3:a:ibm:maximo_network_on_blockchain:7.6.0.1:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2019-4446

Exploit prediction scoring system (EPSS) score for CVE-2019-4446

CVSS scores for CVE-2019-4446

References for CVE-2019-4446

Products affected by CVE-2019-4446