Medium severity · published Mar 12, 2016
CVE-2015-7448
SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0…
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX003, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Change And Configuration Management Database · Ibm
7.1; 7.1.1; 7.1.1.2; 7.1.1.3; 7.1.1.4; 7.1.1.5; +9 more · source: NVD
MA
Maximo Asset Management · Ibm
7.1; 7.1.1; 7.1.1.1; 7.1.1.2; 7.1.1.5; 7.1.1.6; +21 more · source: NVD
MA
Maximo Asset Management Essentials · Ibm
7.1; 7.5; 7.5.0.0; 7.5.0.1; 7.5.0.2; 7.5.0.3; +6 more · source: NVD
MF
Maximo For Energy Optimization · Ibm
7.1 · source: NVD
MF
Maximo For Government · Ibm
7.1; 7.1.1; 7.5 · source: NVD
MF
Maximo For Life Sciences · Ibm
7.1; 7.5; 7.6 · source: NVD
MF
Maximo For Nuclear Power · Ibm
7.1; 7.1.1; 7.5; 7.5.0.1; 7.5.1 · source: NVD
MF
Maximo For Oil And Gas · Ibm
7.1; 7.1.0.1; 7.1.1.0; 7.1.2; 7.5; 7.5.1 · source: NVD
MF
Maximo For Transportation · Ibm
7.1; 7.1.0.1; 7.1.1; 7.1.1.1; 7.5.0.0; 7.5.1.0; +1 more · source: NVD
MF
Maximo For Utilities · Ibm
7.1; 7.1.1; 7.1.2; 7.5; 7.5.0.1 · source: NVD
SC
Smartcloud Control Desk · Ibm
7.5; 7.5.0.1; 7.5.0.2; 7.5.0.3; 7.5.1.0; 7.5.1.1; +6 more · source: NVD
TA
Tivoli Asset Management For IT · Ibm
7.1; 7.2; 7.2.0.1; 7.2.1.0; 7.2.1.2; 7.2.2; +2 more · source: NVD
Affected product
CA
Change And Configuration Management Database
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7448
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21974938
More from Change And Configuration Management Database
9.8
CVE-2013-3323
A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure to invalidate the…
8.8
CVE-2015-0104
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and…
6.5
CVE-2015-0107
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and…
5.4
CVE-2015-5017
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and…
4.3
CVE-2015-5016
IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Management for IT 7.1 and 7.2; and certain…