CVE-2019-4288

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160631.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
IBM	Maximo Anywhere	7.6.2.0; 7.6.2.1; 7.6.3.0; 7.6.3.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/160631VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6202708Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/160631VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6202708Patch, Vendor Advisory

Timeline

Published: Apr 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-42916.5IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IB CVE-2019-42928.8IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code CVE-2019-42935.3IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default installation, which could CVE-2019-42947.8IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through CVE-2019-42954.9IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from t CVE-2019-42963.3IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from th CVE-2019-42975.4IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By usin CVE-2019-42987.1IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a CVE-2019-42995.5IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files wh CVE-2019-43018.4BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Me CVE-2019-43035.4IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2019-43046.3IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validati