CVE-2017-1352

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
IBM	Maximo Asset Management	7.5; 7.6

References

http://www.ibm.com/support/docview.wss?uid=swg22006650Vendor Advisory
http://www.securityfocus.com/bid/100697Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126538Third Party Advisory, VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22006650Vendor Advisory
http://www.securityfocus.com/bid/100697Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126538Third Party Advisory, VDB Entry

Timeline

Published: Sep 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-13533.5IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting use CVE-2017-13545.4IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2017-13553.7IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if una CVE-2017-13568.8IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,CVE-2017-13574.3IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to c CVE-2017-13595.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-13627.8IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-F CVE-2017-13635.4IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web CVE-2017-13645.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-136486.5In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.CVE-2017-136495.5UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbi CVE-2017-13655.4IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. T