CVE-2015-0104: ibm change_and_configuration_management_database Improper Access Control
Vulnerability summary
CVE-2015-0104 is a high (CVSS 8.8) Improper Access Control vulnerability in ibm change_and_configuration_management_database. EPSS estimates a 6.85% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 24-04-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
6.85%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.85% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ibm11 products
- change_and_configuration_management_database7.1 | 7.2
- maximo_asset_management7.1 | 7.1.1 | 7.1.1.1 | 7.1.1.2 | 7.1.1.5 | 7.1.1.6 | 7.1.1.7 | 7.1.1.8
- maximo_asset_management_essentials7.1
- maximo_for_government7.1
- maximo_for_life_sciences7.1
1 vendor · 11 products