CVE-2015-7451: ibm maximo_asset_management Cross-site Scripting

Vulnerability summary

CVE-2015-7451 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in ibm maximo_asset_management. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities.

Timeline

1. 02-01-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.