High severity · published Oct 29, 2019
CVE-2019-4546
After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normally allowed to access
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normally allowed to access. IBM X-Force ID: 165948.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Maximo For Oil And Gas · Ibm
7.6.1 · source: NVD
MH
Maximo Health, Safety And Environment Manager · Ibm
7.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-4546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-4546
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/165948
Vendor Advisory
https://www.ibm.com/support/pages/node/1087738
More from Maximo For Oil And Gas
9.8
CVE-2013-3323
A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure to invalidate the…
8.8
CVE-2018-1524
IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to the system
8.8
CVE-2015-0104
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and…
8.2
CVE-2020-4409
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack
8.0
CVE-2019-4364
IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system