CVE-2016-9977
high
CVSS v3
8.8
CVSS v2
6.5
VIR risk
8.8
Description
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@us.ibm.com — https://exchange.xforce.ibmcloud.com/vulnerabilities/120253
Vendor advisory: psirt@us.ibm.com — http://www.ibm.com/support/docview.wss?uid=swg22003981
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | maximo_asset_management | 7.1 | |
| ibm | maximo_asset_management | 7.5 | |
| ibm | maximo_asset_management | 7.6 | |
| ibm | maximo_asset_management_essentials | 7.1 | |
| ibm | maximo_asset_management_essentials | 7.5 | |
References
- http://www.ibm.com/support/docview.wss?uid=swg22003981
- http://www.securityfocus.com/bid/98786
- https://exchange.xforce.ibmcloud.com/vulnerabilities/120253
- http://www.ibm.com/support/docview.wss?uid=swg22003981
- http://www.securityfocus.com/bid/98786
- https://exchange.xforce.ibmcloud.com/vulnerabilities/120253
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.