CVE-2014-0825
IBM Maximo Asset Management 7.x < 7.1.1.12 and 7.5.x < 7.5.0.5 - Authenticated XSS via openreport.jsp
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21670870
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90501
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV53362
Scores
EPSS
0.0094
EPSS Percentile
57.1%
Details
CWE
CWE-79
Status
published
Products (43)
ibm/change_and_configuration_management_database
7.0
ibm/change_and_configuration_management_database
7.1
ibm/change_and_configuration_management_database
7.1.1.7
ibm/change_and_configuration_management_database
7.1.1.11
ibm/change_and_configuration_management_database
7.1.1.12
ibm/maximo_asset_management
7.1
ibm/maximo_asset_management
7.1.1
ibm/maximo_asset_management
7.1.1.1
ibm/maximo_asset_management
7.1.1.2
ibm/maximo_asset_management
7.1.1.5
... and 33 more
Published
May 26, 2014
Tracked Since
Feb 18, 2026