CVE-2014-3025
IBM Maximo Asset Management 6.2-6.2.8, 6.x, 7.1-7.1.1.2, 7.5-7.5.0.6 - Authenticated Cross-Site Scripting via .jsp Input
Title source: llmDescription
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.2, and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via unspecified input to a .jsp file under webclient/utility/.
References (5)
Core 5
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21678754
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59640
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/93064
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59570
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV57241
Scores
EPSS
0.0095
EPSS Percentile
57.5%
Details
CWE
CWE-79
Status
published
Products (50)
ibm/maximo_asset_management
6.2
ibm/maximo_asset_management
6.2.1
ibm/maximo_asset_management
6.2.2
ibm/maximo_asset_management
6.2.3
ibm/maximo_asset_management
6.2.4
ibm/maximo_asset_management
6.2.5
ibm/maximo_asset_management
6.2.6
ibm/maximo_asset_management
6.2.6.1
ibm/maximo_asset_management
6.2.7
ibm/maximo_asset_management
6.2.8
... and 40 more
Published
Jul 30, 2014
Tracked Since
Feb 18, 2026