Description
Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to read arbitrary files via a .. (dot dot) in a pathname.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98605
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21694035
Scores
EPSS
0.0144
EPSS Percentile
70.0%
Details
CWE
CWE-22
Status
published
Products (48)
ibm/change_and_configuration_management_database
7.1
ibm/change_and_configuration_management_database
7.2
ibm/maximo_asset_management
7.1
ibm/maximo_asset_management
7.1.1
ibm/maximo_asset_management
7.1.1.1
ibm/maximo_asset_management
7.1.1.2
ibm/maximo_asset_management
7.1.1.5
ibm/maximo_asset_management
7.1.1.6
ibm/maximo_asset_management
7.1.1.7
ibm/maximo_asset_management
7.1.1.8
... and 38 more
Published
Feb 17, 2015
Tracked Since
Feb 18, 2026