| Vulnerability Name: | CVE-2011-4818 (CCN-72006) | ||||||||
| Assigned: | 2011-12-14 | ||||||||
| Published: | 2012-02-14 | ||||||||
| Updated: | 2018-01-10 | ||||||||
| Summary: | Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter to an unspecified component. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-20 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-4818 Source: SECUNIA Type: UNKNOWN 48299 Source: AIXAPAR Type: UNKNOWN IV09200 Source: CCN Type: IBM Security Bulletin 1584666 Security Vulnerabilities Addressed in Asset and Service Mgmt Source: CONFIRM Type: Vendor Advisory http://www.ibm.com/support/docview.wss?uid=swg21584666 Source: CCN Type: OSVDB ID: 79901 IBM Maximo Asset Management Multiple Product uisessionid Parameter Arbitrary Site Redirect Source: BID Type: UNKNOWN 52333 Source: CCN Type: BID-52333 IBM Maximo Asset Management Multiple Security Vulnerabilities Source: XF Type: UNKNOWN maximo-uisessionid-open-redirect(72006) Source: XF Type: UNKNOWN maximo-uisessionid-open-redirect(72006) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||